edx-solutions/edx-platform — pull request #59 by muhhshoaib (2014-05-21 10:37:33+00:00)
Title: Muhhshoaib/security change user password requirements 685

Password complexity:

Changes have been made against [MCKIN-685] in order to make any of the password complexity level optional. We have introduced MINIMUM_PASSWORD_COMPLEXITY_SCORE setting which can be used to set a minimum score required to fulfill password complexity levels. This new setting will effect the system only if it is defined.

Each password complexity level('PUNCTUATION', 'DIGITS', 'NON ASCII', 'WORD') has a score of 2 except “UPPER” and “LOWER” these two have score of 1 each. So to set configuration with password complexity of minimum of 8 characters and satisfy 2 out of these three:
- Letters and numbers
- Uppercase and lowercase letters
- One or more special characters

We can use
MINIMUM_PASSWORD_COMPLEXITY_SCORE = 4

and
PASSWORD_MIN_LENGTH = 8
PASSWORD_COMPLEXITY = {
'UPPER': 2,
'LOWER': 2,
'PUNCTUATION': 2,
'DIGITS': 2
}
@mattdrayer @chrisndodge Kindly review the changes