You're on your way to the next level! Join the Kudos program to earn points and save your progress.
Level 1: Seed
25 / 150 points
1 badge earned
Challenges come and go, but your rewards stay with you. Do more to earn more!
What goes around comes around! Share the love by gifting kudos to your peers.
Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!
Join now to unlock these features and more
We are using Crowd 4.2.2. We've set up a directory server to authenticate users using LDAP and enforcing password policy.
I understand that for an internal directory, we can set up regex to validate the passwords against a set of rules that then gives the user the appropriate error if the password doesnt meet regex. However this isnt possible using external directory server - this is fine, except that, when the user's password does not meet LDAP password policy settings, the blanket error message "You do not have permission to change" is given instead of the actual errors stated in the log, ie :
2021-03-04 14:57:02,376 http-nio-8095-exec-12 ERROR [console.action.user.ChangePassword] When changing the user password
com.atlassian.crowd.exception.OperationFailedException: org.springframework.ldap.InvalidAttributeValueException: [LDAP: error code 19 - invalid password syntax - password must be at least 12 characters long]; nested exception is javax.naming.directory.InvalidAttributeValueException: [LDAP: error code 19 - invalid password syntax - password must be at least 12 characters long]; remaining name 'uid=testuser,ou=test ou,dc=com,dc=au"
The "no permission to change" generic error is obviously misleading to users because it implies permission issue, not password requirement issue.
I notice as admin, when changing password for a user as administrator via the Admin console (invoking console.action.principal.UpdatePrincipal in the background), when the password set for user does not meet requirement, it gives you the appropriate descriptive error matching the log.
How can I enable self service console to get the same descriptive logs? Any workaround/hacks??