When using mysql as backend authentication, there’s no password verification when creating a new user or when user change its own password. The PCI guide require some quality requirements regarding the password management, for example: Password Maximum Age Password Strength Minimum Digit Characters Password Minimum Length Password Strength Minimum Uppercase Characters Password Strength Minimum Lowercase Characters Those requirements should be configurables by the administrator, and mandatory for users when they try to change their own password. Use Case: Bank regulatory process require that all systems related to transaction management have restrictions about password management.
PCI work is happening upstream. We are likely to have a better situation in the Newton release. http://git.openstack.org/cgit/openstack/keystone-specs/tree/specs/keystone/newton/pci-dss.rst See the set of posted changes in the Blueprint. https://blueprints.launchpad.net/keystone/+spec/pci-dss Please update this bug accordingly; MAake RFEs fro things not covered, and tracker bugs for the features in upstream that you care about.
A couple of bugs have been reported upstream for this feature [1][2]. [1] has already been merged and backported to stable/newton [3][4], [2] has already been merged [5] but the backport has not been merged yet [6]. [1] https://bugs.launchpad.net/keystone/+bug/1628692 [2] https://bugs.launchpad.net/keystone/+bug/1630092 [3] https://review.openstack.org/#/c/379018/ (master fix for bug [1]) [4] https://review.openstack.org/#/c/379607/ (stable/newton for bug [1]) [5] https://review.openstack.org/#/c/379030/ (master fix for bug [2]) [6] https://review.openstack.org/#/c/383846/ (stable/newton for bug [2])
The final patch for this merged upstream into stable/newton (see comment#5, item#6 for the review link).
verified for openstack-keystone-10.0.0-2.el7ost.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHEA-2016-2948.html