Metadata-Version: 2.4
Name: collective.pwexpiry
Version: 1.0.0
Summary: Emulate Active Directory password complexity requirements                   in Plone
Home-page: http://www.enfoldsystems.com
Author: Enfold Systems, Inc.
Author-email: info@enfoldsystems.com
License: ZPL
Classifier: Programming Language :: Python
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Classifier: Topic :: Security
Classifier: Framework :: Plone
Classifier: Framework :: Plone :: 5.2
Classifier: Framework :: Plone :: 6.0
Classifier: License :: OSI Approved :: Zope Public License
Requires-Dist: setuptools
Requires-Dist: plone.api
Requires-Dist: collective.monkeypatcher
Provides-Extra: test
Requires-Dist: cssselect; extra == "test"
Requires-Dist: lxml; extra == "test"
Requires-Dist: mock; extra == "test"
Requires-Dist: plone.api>=1.8.5; extra == "test"
Requires-Dist: plone.app.robotframework; extra == "test"
Requires-Dist: plone.app.testing[robot]; extra == "test"
Requires-Dist: plone.browserlayer; extra == "test"
Requires-Dist: plone.cachepurging; extra == "test"
Requires-Dist: plone.testing; extra == "test"
Requires-Dist: robotsuite; extra == "test"
Requires-Dist: testfixtures; extra == "test"
Requires-Dist: transaction; extra == "test"
Requires-Dist: tzlocal; extra == "test"
Dynamic: author
Dynamic: author-email
Dynamic: classifier
Dynamic: description
Dynamic: home-page
Dynamic: keywords
Dynamic: license
Dynamic: provides-extra
Dynamic: requires-dist
Dynamic: summary

collective.pwexpiry
===================

Introduction
============

The ``collective.pwexpiry`` package is an add-on Product for Plone that brings the
feature of controlling the password expiration in Plone. It is useful when there's
a need of forcing the portal's members to follow the specific password policy.

Features
========
* Possibility to register and define custom password validation methods
* Possibility to define user's passwords period of validity
* Possibility to check if the password has been used in the last x variants. And disallow
  reuse.
* Possibility to register custom notification actions to be triggered when the password's
  period of validity is getting closer
* Provides a script that can be periodically executed from the command line (i.e. by cron).
  The script checks for the user's passwords expiration dates and triggers the registered
  notification actions (i.e. sending email to the relevant users).
* Provides a protection mechanizm to avoid notifying given user twice the same day
* Possibility to lock an account if too many invalid password attemps were tried

Installation
============

1. Add collective.pwexpiry to your plone.recipe.zope2instance section's eggs::

    [instance]
    recipe = plone.recipe.zope2instance
    ...
    eggs =
        ...
        collective.pwexpiry

2. Install the Product via portal_quickinstaller.

Configuration and customization
===============================

Password period of validity
---------------------------

The password's period of validity is set in the configuration registry tool, and have
a default value of 90 days. It can be easily customized by creating a registry.xml file
in your custom pakage's gereric setup profile containing the configuration code::

    <registry>
        <record name="collective.pwexpiry.validity_period">
            <value>360</value>
        </record>
    </registry>

To disable password expiration, set `validity_period` to `0`.

Last X Passwords check
----------------------

It's possible to check if the new password has already been used (a history of the last `password_history_size` password hashes is kept).

`password_history_size` defaults to 0, which means: there is no active check for re-used passwords.

You need to manualy activate that feature with a registry record in registry.xml::

    <registry>
        <record name="collective.pwexpiry.password_history_size">
            <value>10</value>
        </record>
    </registry>


Defining notification actions
-----------------------------

By default - there is a notification action defined that sends the notification email
to the user when his password period of validity is going to end in 15 days.
But there is a possibility to register a custom methods that would be triggered
according to their implementation.

To register your own notification action you need to::
 1. Register adapter providing ``IExpirationCheck`` interface::

     <configure xmlns="http://namespaces.zope.org/zope">
       <adapter
         name="last_few_days_before_expiration"
         factory=".actions.LastFewDaysBeforeExpiration"
         provides="collective.pwexpiry.interfaces.IExpirationCheck"
         for="zope.interface.Interface"
         />
     </configure>

 2. Implement the adapter's ``__call__`` and ``notification_action`` methods::

      class LastFewDaysBeforeExpiration(object):
          implements(IExpirationCheck)

          # Trigger on number of days before password expiration
          notify_on = (7, 4, 3, 2, 1)

          def __init__(self, context):
              self.context = context

          def __call__(self, days_to_expire):
              """
              Returns True whe n the notification_action
              method have to be executed
              """
              try:
                  notify_on = iter(self.notify_on)
              except TypeError:
                  notify_on = (self.notify_on,)

              if days_to_expire in notify_on:
                  return True
              else:
                  return False

          def notification_action(self, userdata, days_to_expire):
              """
              Implementation of the notification action.
              In this case it's sendin an email notification
              """
              send_notification_email(userdata, days_to_expire)


Defining custom password validation methods
-------------------------------------------

The package allows to define your own password valdation methods
executed when the user set his initial password on registration or
changing his actual password by in the change password form or throught
the password reset mechanizm.

To register your own notification action you need to::

 1. Register adapter providing ``ICustomPasswordValidator`` interface::

     <configure xmlns="http://namespaces.zope.org/zope">
       <adapter
         name="my_password_policy"
         factory=".password_validators.MyPasswordValidator"
         provides="collective.pwexpiry.interfaces.ICustomPasswordValidator"
         for="zope.interface.Interface"
         />
     </configure>

 2. Implement the adapter's ``__call__`` and ``notification_action`` methods::

      class MyPasswordValidator(object):
          implements(ICustomPasswordValidator)

          def __init__(self, context):
              self.context = context

          def validate(self, password, data):
              if len(password) < 8:
                  return _(u'Passwords must be at least 8 characters in length.')

Executing the notification script
---------------------------------

The notification script should be executed **once a day** to check the user's passwords
expiration dates and trigger relevant notification actions.

For convenience, a new command called ``notify_and_expire`` was added to zopectl,
you only need to provide the absolute path to your Plone instance as only argument.

Here's an example of how the script can be executed from the command line::

    $ cd ${buildoout:directory}
    $ ./bin/instance notify_and_expire /opt/plone/buildout/notify_and_expire.log /Plone

This assuming your Plone site id is ``Plone`` and lives at the Zope root, and that you want to save the log in a ``notify_and_expire.log`` file in ``/opt/plone/buildout``


Provide SERVER_URL and SERVER_NAME environment variables
--------------------------------------------------------

The email template will try to get the server URL and server NAME from the request,
and the notification script already puts them in there if it can find it as
environment variables. So if you want to provide users with a better email,
which includes links to reset or change the password, and a message detailing
where the email is coming from, you need to define ``SERVER_URL`` and ``SERVER_NAME``
environment variables.
In order to do this in buildout, you need to set your ``environment-vars`` in your
``[instance]`` section.


Locking out accounts if an invalid password is entered too many times
---------------------------------------------------------------------

When the package is installed, a new PAS plugin is included, which will count invalid password attempts when logging in.
If the number of invalid attempts is higher than a configurable threshold, the account will be locked out for a certain amount of hours.
If the account hasn't been locked yet, entering the password correctly will reset this counter to zero.
An account can be re-activated by an administrator changing its password.


Controlling the additional user's properties
--------------------------------------------

The ``collective.pwexpiry`` package creates new user's properties:
 * ``password_date`` - the date when the user has changed his passoword
 * ``last_notification_date`` - the date when the last notification action has been performed for the user
 * ``account_locked_date`` - the date when the account was locked
 * ``account_locked`` - boolean telling if the account was locked or not
 * ``password_tries`` - the number of incorrect password attempts

In order to be able to control manually the new user's properties manually - there's a
control panel form available under url: ``/@@pwexpiry-controlpanel``.


Setting how many tries before locking the account and for how much time
-----------------------------------------------------------------------

This is managed with values in the registry:

 * ``collective.pwexpiry.allowed_tries`` - Allows you to choose how many attempts are allowed
 * ``collective.pwexpiry.disable_time`` - Allows you to specify for how many hours the user should be locked out


TODO
====

Write tests!
------------

Author & Contact
================

:Author:
 * Radosław Jankiewicz ``radoslaw.jankiewicz@stxnext.pl``

License
=======

This package is licensed under the Zope Public License.

Changelog
=========


1.0.0 (2025-08-06)
------------------

- Add support for Plone 6 and drop support for python 2 and Plone 4.3-5.1.
  [enfold_josh]

- Modify travis config to reflect changes in supported python and plone versions.
  [enfold_josh]

- update to new namespaces
  [MrTango]

- update to use plone.autoinclude.pluging
  [MrTango]


0.15.2 (2023-03-17)
-------------------

- Add ability for the notify_and_expire script to test notifications
  [frapell]

- Hide profiles not intended to be shown in the add-ons control panel
  [frapell]

- Update README
  [frapell]


0.15.1 (2019-12-10)
-------------------

- Do not assume that dates in user's properties are already as DateTime
  [frapell]


0.15.0 (2019-08-01)
-------------------

- Add python 3 and Plone 5.2 support
  [swampmonkey,frapell]


0.14.0 (2018-12-14)
-------------------

- Standrize error messages so it will be the same whether the user was
  locked or the password is incorrect
  [frapell]


0.13.0 (2018-11-08)
-------------------

- Update i18n and add Brazilian Portuguese and Spanish translations.
  [hvelarde]

- Deprecate Plone 4.1, Plone 4.2 and Python 2.6.
  [hvelarde]

- Avoid ``TypeError`` on Password Expiry plugin and ``InvalidPasswordEntered`` subscriber when the list of whitelisted users has not being set.
  [csanahuja, hvelarde]

- Restore compatibility with Plone 4.3.
  [hvelarde]

- Add uninstall profile and tests.
  [hvelarde]


0.12.0 (2018-05-30)
-------------------

- Update german translations
  [fRiSi]

- Refactor the notify_and_expire script so it can be added as a zopectl command
  [frapell]

- Use SERVER_URL and SERVER_NAME for including additional info in emails
  [frapell]


0.11.3 (2017-12-06)
-------------------

- Password validation does not raise UnicodeDecodeError if password
  contains non-ascii characters [fRiSi]


0.11.2 (2017-07-31)
-------------------

- Include upgrade step for the whitelist feature
  [frapell]


0.11.1 (2017-07-31)
-------------------

- Re-release
  [frapell]


0.11 (2017-07-31)
-----------------

- Include the ability to whitelist userids so they would not expire nor be locked
  [frapell]


0.10 (2017-02-21)
-----------------

- Product now works on Plone 5
  [enfold-josh]

- Javascript for login popup is only needed for Plone 4
  [frapell]


0.9.1 (2016-05-23)
------------------

- fix rst2html for pypi page [fRiSi]


0.9 (2016-05-23)
----------------

- Change the E-Mail Template to use a customizeable view.
  [pcdummy]

- Fix an encoding problem with usernames in notify_and_expire.
  [pcdummy]

- Fix javascripts with Plone 4.3.8, theres no more "ieversion()" function.
  [pcdummy]

- Fix translations for "password disabled" statusmessage
  (this fixes #11)
  [fRiSi]

- Update german translations.
  [pcdummy]

- Change the notification e-mail to a translated text e-mail.
  [pcdummy]

- Show status message "your account has expired" in login popup.
  [pcdummy]

- Update german translations.
  [pcdummy]

- Do not exipre passwords if `validity_period` is set to 0
  [fRiSi]

- Add password history check (not in last x passwords).
  [pcdummy]

- Enable the example_validator only when there is a browserlayer.
  [pcdummy]

- Add a skins layer and remove the confusing > 5 chars message from
  pwreset_form.
  [pcdummy]

- Update german translations and translate example_validator.
  [pcdummy]


0.8.1 (2015-05-06)
------------------

- Template typo
  [frapell]

- Update italian translation
  [giacomos]


0.8 (2015-04-20)
----------------

- Update translations
  [frapell]

- Improve control panel tool to allow admins to unlock accounts
  [frapell]


0.7 (2015-03-25)
----------------

- Ignore Managers from password expiring
  [frapell]

- Bugfix: If a wrong password was entered that goes over the limit, do not
  add a response header. Only do it when entering correctly
  [frapell]

- When comparing dates, make sure both are timezone aware
  [frapell]

- Ignore case when checking for name and username in password.
  [enfold-josh]

- Change script to accept a path and use traversal to get plone site since it
  may not always be in the application root.
  [enfold-josh]

- Redirect to $portal_url/mail_password_form instead of just /mail_password_form
  [enfold-josh]

- Alter notification email to support days <= 0.
  [enfold-josh]


0.6 (2015-03-13)
----------------

- Use a friendlier date format for the control panel
  [frapell]


0.5 (2014-11-28)
----------------

- Add i18n and italian translation
  [giacomos]

- No need to include 'control panel' in the control panel title
  [frapell]


0.4 (2014-09-11)
----------------

- Add member properties, registry keys, events subscribers, and a PAS plugin
  to allow blocking a user if he enters too many incorrect passwords.
  [frapell]

- Patch ZODBUserManager.authenticateCredentials so it fires events when entering
  valid or invalid credentials.
  [frapell]

- Patch CMFPlone/RegistrationTool instead of CMFDefault/RegistrationTool.
  [frapell]


0.3 (2014-09-10)
----------------

- Properly package
  [frapell]


0.2 (2013-08-18)
----------------

- correct pypi classifiers

- initial code
