Hi there,
We are using Crowd 4.2.2. We've set up a directory server to authenticate users using LDAP and enforcing password policy.
I understand that for an internal directory, we can set up regex to validate the passwords against a set of rules that then gives the user the appropriate error if the password doesnt meet regex. However this isnt possible using external directory server - this is fine, except that, when the user's password does not meet LDAP password policy settings, the blanket error message "You do not have permission to change" is given instead of the actual errors stated in the log, ie :
2021-03-04 14:57:02,376 http-nio-8095-exec-12 ERROR [console.action.user.ChangePassword] When changing the user password
com.atlassian.crowd.exception.OperationFailedException: org.springframework.ldap.InvalidAttributeValueException: [LDAP: error code 19 - invalid password syntax - password must be at least 12 characters long]; nested exception is javax.naming.directory.InvalidAttributeValueException: [LDAP: error code 19 - invalid password syntax - password must be at least 12 characters long]; remaining name 'uid=testuser,ou=test ou,dc=com,dc=au"
The "no permission to change" generic error is obviously misleading to users because it implies permission issue, not password requirement issue.
I notice as admin, when changing password for a user as administrator via the Admin console (invoking console.action.principal.UpdatePrincipal in the background), when the password set for user does not meet requirement, it gives you the appropriate descriptive error matching the log.
How can I enable self service console to get the same descriptive logs? Any workaround/hacks??
Thanks!
Jane
