Module io.inverno.mod.security
Package io.inverno.mod.security.authentication.password

Interface PasswordPolicy<A extends LoginCredentials,B extends PasswordPolicy.PasswordStrength>

Type Parameters:
A - the login credentials type
B - the password strength type
All Known Implementing Classes:
SimplePasswordPolicy
public interface PasswordPolicy<A extends LoginCredentials,B extends PasswordPolicy.PasswordStrength>

A password policy is used to evaluate the strength of a password in a login credentials against specific rules.

The password strength returned by verify(io.inverno.mod.security.authentication.LoginCredentials, java.lang.String) provides both a qualitative and quantitative marks that expose the level of protection of a password. A PasswordPolicyException is thrown when a password does not comply with the policy and should be rejected.

Properly secured password policy implementations should consider NIST Digital Identity Guidelines Section 5.1.1.2.

Since:
1.5
Author:
Jeremy Kuhn

  • Nested Class Summary

    Nested Classes
    Modifier and Type
    Interface
    Description
    static interface 
    PasswordPolicy.PasswordStrength
    A password strength provides both qualitative and quantitative marks to assess its level of protection against password cracking attacks.

  • Method Summary

    Modifier and Type
    Method
    Description
    B
    verify(A credentials, String rawPassword)
    Verifies that the specified raw password complies with the policy.

  • Method Details

    • verify

      B verify(A credentials, String rawPassword) throws PasswordPolicyException

      Verifies that the specified raw password complies with the policy.

      Parameters:
      credentials - the current user credentials for which the password should be defined
      rawPassword - the raw password to check
      Returns:
      a password strength
      Throws:
      PasswordPolicyException - if the specified password does not comply with the password policy