How to implement a password expiration policy in JIRA?

Question

Per JRA-2740, I know it's something that it's offer by Crowd but not JIRA itself.  But I would like to know if anyone has any resolution on forcing password policy per JIRA logins.  Like Ideally, I would want it to email the users that their passsword is about to expire and give them 30 days before expiring it.  The only way I can see so far is to do some sort of Oracle batch for pulling the accounts that are about to expire and then update the accounts to expired or lock the account after the 30 days notice.  But that seems like a hack, and not to mention, I dont know what kind of things it would do performance wise.

Any help is greatly appeciated :)

Tiago Comasseto · Answer

Hi Eva,

I don't see a way to do it within JIRA too. Are your users stored into the internal directory or coming from an external source, such as an LDAP?

If they are internal, the Oracle batch seems to be an alternative, but yes, it would affet the performance of your database.

It would be something relatively easy if the users are comming from an LDAP, Microsoft AD for example has native tools to expire the passaword.

Cheers

Matheus Fernandes · Answer

This is also a feature request for JIRA, see: Rules Governing Passwords - Password Policy. There are some workarounds mentioned in the comments of the feature request that could possibly help you.