When using mysql as backend authentication, there’s no password verification when creating a new user or when user change its own password.
The PCI guide require some quality requirements regarding the password management, for example:
Password Maximum Age
Password Strength Minimum Digit Characters
Password Minimum Length
Password Strength Minimum Uppercase Characters
Password Strength Minimum Lowercase Characters
Those requirements should be configurables by the administrator, and mandatory for users when they try to change their own password.
Bank regulatory process require that all systems related to transaction management have restrictions about password management.
PCI work is happening upstream. We are likely to have a better situation in the Newton release.
See the set of posted changes in the Blueprint.
Please update this bug accordingly; MAake RFEs fro things not covered, and tracker bugs for the features in upstream that you care about.
A couple of bugs have been reported upstream for this feature .  has already been merged and backported to stable/newton ,  has already been merged  but the backport has not been merged yet .
 https://review.openstack.org/#/c/379018/ (master fix for bug )
 https://review.openstack.org/#/c/379607/ (stable/newton for bug )
 https://review.openstack.org/#/c/379030/ (master fix for bug )
 https://review.openstack.org/#/c/383846/ (stable/newton for bug )
The final patch for this merged upstream into stable/newton (see comment#5, item#6 for the review link).
verified for openstack-keystone-10.0.0-2.el7ost.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.