Repository navigation
KC-1423: fix validation for passwords and passphrase in record creation and updation - #2330
Closed
sshrushanth-ks wants to merge 5 commits into
Closed
sshrushanth-ks wants to merge 5 commits into
sshrushanth-ks wants to merge 5 commits into
Conversation
craiglurey
reviewed
Aug 28, 2026
craiglurey
left a comment
craiglurey
left a comment
Contributor
There was a problem hiding this comment.
I don’t agree with this. The whole point of enterprise enforcements is to ensure that users can’t type or generate a weak password. The functionality of Commander needs to be the same as the user on the vault. I'd like to understand where this requirement came from.
Contributor
We identified a bug in Commander: when both password and passphrase policies were applied, it incorrectly validated constraints across fields - for example, displaying a passphrase policy error while a user was entering a password. |
sshrushanth-ks
force-pushed
the
passphrase-policy-validation-fix
branch
from
October 15, 2026 05:49
ed58f2e to
3321146
Compare
sshrushanth-ks
marked this pull request as draft
October 15, 2026 05:50
sshrushanth-ks
requested review from
craiglurey
and removed request for
craiglurey and
sk-keeper
October 15, 2026 05:50
…on and updation (#2314) * fix validation for passwords and passphrase in record creation and updation * Fix generated password policy validation after review - Track generated key-pair passphrases - Centralize v3 add/edit policy validation - Preserve random-password diagnostics - Keep manual passwords exempt from generated-password policy - Add regression coverage across record and NSF commands * Validate generated passwords at generation site instead of post-hoc via instance flags. This fixes two issues: 1. v3 add/edit --generate now validates (was silently bypassed) 2. No cross-field contamination in multi-field records Manual passwords remain unvalidated (handled by BreachWatch). * updated failing test
…on and updation, and apply domain-specific policies to manual passwords and passphrases (#2453) * fix validation for passwords and passphrase in record creation and updation * Apply domain-specific policies to generated and manual passwords Select generator policies by record URL and validate generated passwords and passphrases with their respective rules. Apply explicit domain policies to manually entered passwords and passphrases, while leaving manual entries unchecked when no domain policy matches. Cover record add and update flows, including legacy and nested records. Add regression tests for policy selection and manual password validation. * Handle Unicode passphrases in domain policy validation Normalize passphrase words to NFC and accept Unicode letters during manual passphrase validation. Remove the unused NSF field resolver and add regression coverage for domain-policy enforcement in NSF updates. * Apply domain password rules to manual entries without inferring passphrase intent from separators. Keep passphrase rules for generated passphrases and add regression coverage for hyphenated passwords. * Addressed review comments: Use matching domain settings for passphrase generation and allow manual entries that satisfy the domain’s password or permitted passphrase rules. Prefer the primary record URL, add a policy override for legacy edits, and revalidate manual passwords on NSF update retries. Add regression coverage for policy selection, URL precedence, overrides, and retry validation.
sshrushanth-ks
force-pushed
the
passphrase-policy-validation-fix
branch
from
October 30, 2026 13:44
0465a0a to
e0fd975
Compare
Contributor
Author
|
Latest PR:#2482 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Apply password complexity rules to generated passwords, passphrase rules to generated passphrases, and matching domain-specific policies to manually entered passwords and passphrases. Manual entries are not checked against generator defaults when no domain policy matches.
Changes
--forceoverride.