How can we implement customize password policy for Bitbucket

[Nawal Sharma]

How can we implement customize password policy for Bitbucket. In case we want to have complex password policy like 4 numeric and 4 alphanumeric .

[Nawal Sharma]

Can we integrate confluence or JIRA with on server Bitbucket to enforce customized password policy.

[Marty]

Hi Nawal,

yes when you have multiple Atlassian products installed you can use a User Directory called Atlassian Crowd.

https://confluence.atlassian.com/display/CROWD/Configuring+an+Internal+Directory

I hope that helps!

[Marty]

Hi Nawal,

for Bitbucket Server, this functionality does not appear to exist in Bitbucket.  Instead, typically Customers connect to an external User Directory via the LDAP protocol.  The User Directory would then control the password policy.

https://confluence.atlassian.com/bitbucketserver/connecting-bitbucket-server-to-an-existing-ldap-directory-776640403.html

https://confluence.atlassian.com/bitbucketserver/delegating-bitbucket-server-authentication-to-an-ldap-directory-776640402.html

I hope that helps!

[Marty]

Hi Nawal,

I dug a little deeper on this and it looks like, if you use Bitbucket Server without an LDAP directory then it will use an Atlassian product called Crowd to manage a local user base.  

You can configure a regular expression for passwords there: https://confluence.atlassian.com/display/CROWD/Configuring+an+Internal+Directory?_ga=2.250763654.1691782868.1549600512-1540663825.1539569898

I hope that helps!

[Nawal Sharma]

Thank you all of u. I am using server version and wanted to implement client customized password policy. And am really surprised to check that the issue has been highlighted in 2017 as a critical requirement from security and customer ask.

[Darren Chuwa]

Hey Marty,

Appreciate your valuable information.

So the Crowd internal directory have to be installed additionally? Or it's already built-in with Bitbucket installation, and just requires to be enabled via settings?

[Marty]

Hi Nawal,

are you using the Cloud or Server version of Bitbucket?

I'm not on the Bitbucket team, but I'll try and work this out.

If you are using Bitbucket Cloud, then you can setup password policies for all your Atlassian Cloud Products using Atlassian Access: https://confluence.atlassian.com/cloud/password-policies-938859739.html

I haven't found anything yet for Bitbucket Server, have reached out to the team informally, will let you know if/when I get a response.

I hope that helps!