Event Request on Changing Password

[KiprotichKelly]

🕮 Describe the issue
I would like to add an event that allows you to implement password policy on old and new password while changing your user passwords

🔧 To Reproduce

The current code only has only one integration event to modify password minimum length only

📣 Expected behavior

The current code works fine, this is an additional feature. You can then check that users don't reenter their old passwords asthe new password

Screenshots

Additional context

Add any other context about the problem here.

[JesperSchulz]

Is the only ask to add the rule "You can then check that users don't reenter their old passwords as the new password"? Question is if we need an event, or if you should just add that rule to the base product. It's a common security best practice.
Adding an event here has security impact.
Also: moving to BCApps, which is the new repository for System Application related asks.

[JesperSchulz]

@KiprotichKelly, could you look at the question above. Do you still need that event?

[KiprotichKelly]

Hello @JesperSchulz, having mentioned the security concern, I think adding the rule to the base app will do for me.

[JesperSchulz]

Based on the above, I will approve this issue for contribution :-)
Feel free to create a PR which adds the password rule that a user may not reuse the old password as the new one.

[Drakonian]

Since this is still here, can I create a PR?

@JesperSchulz

[JesperSchulz]

Absolutely 😊

[Drakonian]

@JesperSchulz

Just wondering, in the current implementation the method takes two parameters OldPassword and Password. It is clear about Password, it is a new password that the user sets, but about OldPassword it is not so clear, this field always returns what the user fills in the Old Password field, but it is never set from outside, that is, this field is always empty when opening the password change dialog.

BCApps/src/System Application/App/Password/src/PasswordDialogImpl.Codeunit.al

Line 71 in c651de6

procedure OpenChangePasswordDialog(var OldPassword: SecretText; var Password: SecretText)

Which kind of implies that validation of whether the old password was entered correctly is done externally, in the place where this module is called.

Therefore, in order to implement validation inside PasswordDialogManagement it is necessary to pass OldPassword to the Password Dialog page. In such a scenario, the one who uses the OpenChangePasswordDialog method passes OldPassword with the value of the old password from the very beginning, at the moment it is just a Return Value for what the user will enter in the OldPassword field.

Do you agree with this addition?

[Drakonian]

@JesperSchulz in this case it will be two rules

1.Passed OldPassword same as what user fill to OldPassword field in Change Password dialog
2.New password is not equal to OldPassword

[JesperSchulz]

@JesperSchulz in this case it will be two rules

1.Passed OldPassword same as what user fill to OldPassword field in Change Password dialog 2.New password is not equal to OldPassword

That's how I understand this issue, yes 😊