Charles Hedrick via FreeIPA-users wrote:
The NIST recommendations for passwords say they don’t think character
classes and expiration are useful. Instead, they recommend using a blacklist of known
common passwords. There’s no way to implement this policy without writing your own plugin.
It would be useful for IPA’s password policy to allow you to specify a database of
forbidden passwords.
We’ve done this using a plugin, but I’d rather not have to write C code to implement
policy.
This sort of falls under the long-standing upstream issue
https://pagure.io/freeipa/issue/5948 , the idea being that socket
activation is used to pass off policy onto some configurable daemon
which would return a yes/no.
Password policy is very much hardcoded in IPA for old, legacy reasons.
And I'll just throw out that patches are welcome, even if they need some
additional work.
rob