dev@glassfish.java.net

Re: remove password length restrictions

From: Bill Shannon <bill.shannon_at_sun.com>
Date: Wed, 16 Sep 2009 16:47:52 -0700

Kedar Mhaswade wrote on 09/16/09 16:18:
> Bill Shannon wrote:
>> This issue came up in our discussions of the issues related to removing
>> the anonymous user...
>>
>> I need to change the requirements on password length. Currently
>> passwords
>> are required to be at least 8 characters. Obviously the new default
>> password "" violates that requirement so at the very least I need to
>> allow empty passwords or 8+ character passwords.
>>
>> Ideally, if there were constraints on the password, they would be
>> based on
>> some pluggable policy, perhaps associated with the realm implementation,
>> and enforced on the server (not the client as they are today). I think
>> that's work for a future release...
>>
>> Several people have been supportive of removing all restrictions on
>> password
>> length. Unless I hear strong complaints otherwise, that's what I plan
>> to do.
>
> You imply all the GF v3 interfaces including the installer, right?
> +1.

Good point. I'll depend on the installer people to fix it there as
well, or point me at the code so I can fix it for them.