Harbor: User password management & length

[RRAlex]

There doesn't seem to be an interface to change the user's password as admin and if you delete the user to recreate it, system will say user exists!
This breaks user management when passwords need to be changed. :(

Secondly, the passwords seem to be limited to a short 20 characters...
Any reason why it couldn't be say 63 or 255?

cheers!

[reasonerjt]

@RRAlex
Currently for audit purpose, when admin delete a user, the user is just "soft deleted", i.e. user with the same username can not be created again.

So you want to enable admin to update a user's password so the username can be re-used?

[RRAlex]

So deleting a user would also delete its activity log?

But yes, indeed, simply being able to update a user's password would be sufficient.
This would allow anyone to re-purpose an account: be it to rotate admins creds., correct a mistake, respect password change policy, etc.
And it's much more practical then going into MySQL to delete it manually and re-create / re-attribute the role everywhere, which is management hell and, well, bad UX.

thanks! :-)

[reasonerjt]

So deleting a user would also delete its activity log?

Currently activitly log is associate to user table via a Foreign Key, I know this is debatable, but we may use the term to "Disable" a user, not Delete.

As for enabling admin to update password, the original idea is no one should know any other's password including admin, but it makes sense to me when you mention password change policy, we'll consider implement it.

[fuhbar]

@reasonerjt What about the second question @RRAlex raised, the password length? It seems to be restricted to max 20 chars. Is this on purpose? And if so, why?

[bergtwvd]

The ability for the admin to reset a user password is essential in at least the following situation:

• no LDAP
• no mail server
• user has forgotten his password

But also in the following situation:

• no LDAP
• mail server
• user has changed email address, and forgotten his password

[tronicum]

Yeah I would love if we could reset passwords via the web ui..., too

[bengadbois]

It would be nice to have the length restriction presented to the user when setting the password

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[reasonerjt]

Now Admin can update password of a regular user, closing.

[phenomax]

@reasonerjt What about the rather restrictive password length?