Ask MY-Community
Damien TEMPLER
Damien TEMPLER
·PS at Memority

Dynamic Password Expiry based on attributes / rights ?

Resolved

Hi,

I would like to adapt the password expiry date based on an identity's attributes or roles (both are linked in this context).

For example, regular users should have to renew their password after 180 days, however if they gain admin rights, their password should expire after 60 days.

How can I force a password reset if the user becomes admin, say, 65 days after defining their password (65 is fine for users, not for admins)?

Thanks

Data model, Authentication
5 replies
Best reply by Damien TEMPLER

Regarding the first issue mentioned in the post, I ended up creating an Object Policy checking not the expiry but the password definition date (meta attribute _passwordResetAt).

I had issues processing this attribute as it is an OBJECT. I figured turning it into an Instant worked in order to compare it with another date.

<script><![CDATA[
    import com.memority.citadel.shared.api.im.operation.ObjectOperation
    import java.time.Instant
    import java.time.temporal.ChronoUnit

    if (OBJECT._passwordResetAt) {
        Instant resetAt = OBJECT._passwordResetAt as Instant
        def passwordResetOver60DaysAgo = resetAt.plus(60, ChronoUnit.DAYS).isBefore(Instant.now())
        if (%CONTEXT_SPECIFIC_CONDITION%) && passwordResetOver60DaysAgo) {
            if (!OBJECT.loginTasks) {
                OBJECT.loginTasks = ["PASSWORD_CHANGE_REQUESTED"]
            } else {
                OBJECT.loginTasks.add("PASSWORD_CHANGE_REQUESTED")
            }
        }
    }
]]></script>
View original