Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1425412

Summary:	[Docs][RFE][Admin] Document that user can reset expired password
Product:	Red Hat Enterprise Virtualization Manager	Reporter:	Lucy Bopf <lbopf>
Component:	Documentation	Assignee:	Byron Gravenorst <bgraveno>
Status:	CLOSED NOTABUG	QA Contact:	Avital Pinnick <apinnick>
Severity:	unspecified	Docs Contact:
Priority:	medium
Version:	4.0.0	CC:	apinnick, lsurette, mgoldboi, mperina, rbalakri, srevivo, ykaul, ylavi
Target Milestone:	ovirt-4.1.6	Keywords:	FutureFeature, Reopened
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-11-08 12:02:26 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	Docs	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1037844
Bug Blocks:

Description Lucy Bopf 2017-02-21 11:54:40 UTC

Previously, if a user password expired, it needed to be reset on the LDAP server. Now there is a new capability added to the LDAP and JDBC extensions to enable changing passwords from the front end in a new change password screen.

The login procedure must be amended to account for a use case where the password is expired and the machine now prompts the user with a password dialogue. Assignee should assess whether this needs to be called out explicitly in the documentation or is clear enough in the UI.

Comment 2 Lucy Bopf 2017-08-11 07:00:29 UTC

Assigning to Byron for review.

Comment 5 Avital Pinnick 2017-09-13 04:59:19 UTC

Yaniv,

Why are we using expiring passwords? The policy of forced password expiry is generally rejected by security experts. I can't think of any good reason for enabling this policy.

https://www.ncsc.gov.uk/articles/problems-forcing-regular-password-expiry

https://cryptosmith.com/password-sanity/exp-harmful/

https://arstechnica.com/information-technology/2016/08/frequent-password-changes-are-the-enemy-of-security-ftc-technologist-says/

Comment 6 Yaniv Lavi 2017-09-13 09:05:08 UTC

Moran, can you comment?