Password expiry
Requirements & specifications
Abstract
This document describes a new feature that will be part of the version 4 of the software. It is aimed at stakeholders and passbolt staff to understandPass the goals and implementation details. The goal of the feature in a nutshell is to allow users to view which password should be changed as a consequence of offboarding users and/or set passwords as to be changed manually.
Status: APPROVED
Classification: PUBLIC CC BY-SA 4.0
Change history
Date | Author | Changes |
03/03/2021 | Remy | Initial version |
13/03/2021 | Remy | Finalise scope / first stories and wireframes |
25/08/2021 | Vivien | High fidelity wireframes |
31/08/2021 | Kevin, Remy, Cedric, Vivien | Review |
01/09/2021 | Vivien | Complete re-work of functional specs and users stories |
12/11/2021 | Remy / Vivien | Review |
15/11/2021 | Vivien | Functional specs minor modification (UI) + updating user stories |
10/10/2023 | Stéph | Update the document on the technical specs and User Stories |
Index
High level requirements and Wireframes for Passbolt CE 7
Password is going to expire 11
User has been removed from a group and lost access to shared resources 11
User has lost access to a shared resource 11
User has been deleted (?disabled) 11
Group has been deleted (?disabled) 11
High level requirements and Wireframes for Passbolt Pro 14
User stories for Passbolt CE 21
Resource expired wrapper component 21
As a user I can see the resource expiry status● 21
As a logged in user on the password workspace I can see the expiry column in the grid● 21
As a logged in user on the password workspace I can customise the grid with the expiry column● 22
As a logged in user on the password workspace I can sort resources by expiry● 22
As a logged in user on the password workspace I can filter the grid by expired resources● 24
As a user I can mark resources as expired automatically● 24
As a user I can reset resource expiry date● 25
As a resource owner, I’m notified when a resource scheduled for expiry is expired● 25
As a user I can receive an email digest when several secrets need to be changed.● 26
As an administrator I can set the resource expiry email notification● 27
As an administrator I can enable password expiry ● 27
As an administrator I can enable password expiry settings● 27
As an administrator I can delete automatic expiry renewal when users change their secrets● 28
User stories for Passbolt EE 29
As a user I can see the resource expiry status● 29
As a user I can change the expiry date of a resource automatically● 29
As a logged in user when I change a password it renews the expiry date ● 29
As a logged in user in Passbolt EE, I can trigger the password dialog● 30
As a logged in user in Passbolt EE, I see Password expiry dialog● 31
As a logged in user in Passbolt EE, I can optionally change the expiry date of a resource● 31
Option 1: with duration in days● 31
Option 2: with a date picker● 32
As a user on the password workspace I see expiry info in the resource sidebar.● 33
Quickly/multi mark as expired/reset expiry● 33
As a user on the password workspace I can import password expiry date from KDBX files.● 34
As a user on the password workspace I can export password expiry dates from KDBX files.● 34
As an administrator I can set email notification on resource expiry● 35
As an administrator I can set when automatic expiry is triggered● 35
As an administrator I can set when users can override the expiry policy● 36
As an administrator I can set an automatic expiry renewal when users change their secrets● 37
Password expiry settings format ● 39
GET /settings.json (updated) ● 40
POST /password-expiry/settings.json (new) ● 42
GET /password-expiry/settings.json (new) ● 43
DELETE /password-expiry/settings/<uuid>.json ● 44
GET /resources/<uuid>.json (update) ● 45
GET /resources.json (update) ● 46
POST /resources.json (update) ● 47
PUT|POST /resources/<uuid>.json (update) ● 49
POST /password-expiry/resources.json ● 49
Introduction
Password rotation is a controversial topic. One could argue that a blanket policy to rotate passwords every 60 days generally leads to poor password hygiene and/or places an additional burden on individuals and organisations alike.
However it is still a requirement in many organisations that implement such a policy, they see it as a way to reduce the window of opportunity for attackers in case of an undetected leak or basically just have to do it because of regulations.
Moreover there are some more clear legitimate cases for password rotation, mainly when a password was shared with a group of people and that the group composition has changed, typically when a user leaves a group or the organisation. Or alternatively when a password is meant to be shared temporarily with someone (as a single use for example).
Included scope
The goal of this feature is to help support the use cases of password rotation as part of the off-boarding of users or when passwords are manually marked as expired, now or in the future. Expired resources should remain accessible (so that they can be changed).
In short this version includes:
- Setting and viewing expiry date on resources using the API.
- Setting and viewing expiry date on resource create / update dialog.
- Auto update of a resource expiry when a permission to a resource is removed (because of changes via a share, or via group membership, or when a user is deleted).
- Email notifications when a resource expires prompting the owner to change and associated email notification settings and digests.
- A basic version of Password Expiry for Passbolt CE
- A full version of Password Expiry for Passbolt EE
- Setting automatic expiry dates from administrators rotation policies.
- Setting expiry dates of existing passwords.
Excluded scope
This version of the functionality does not include:
- Setting expiry based on usage (ex. mark as expired if X accesses Y).
- Reporting on the compliance of whether a given password rotation policy is met or not.
- Similarly it doesn’t cater for the “share for a single time” use case.
All these different features will be part of a separate improvement, however the suggested design in this document aims to take into account these requirements to enable them more easily in the future.
Functional specifications
High level requirements and Wireframes for Passbolt CE
The Passbolt CE version of Password expiry solves a security issue, when a password was shared with a group of people and that the group composition has changed.
No expiry date can be set manually and resources expiry only have 2 states:
- “Never”: the resource expiry date is not set
- “Expired”: the resource expiry date is set to before now.
When password expiry is enabled, by default all resources expiry date are empty.
When a user or a group is removed from the permission list, the corresponding resources are set as expired with the current time when the action is done.
When the owner of an expired resource is changing the secret, the resource expiry date is again set to empty and thus will be shown as “never”.
Resource workspace
Users must be able to view the expiry time of each resource in the grid.
Expired resources are shown with @red colour in the expiry column and an alert @orange dot, to put a visual emphasis that an action is needed.
Fig. 1.1 Password workspace with expired resource (source figma)
Users must be able to understand why their resource expired.
In the activity section of the information sidebar, users can see the reason why the resource is set to expire.
A “breadcrumb” of alert @orange dots appears next to the information section and the avatar.
A new information item list named “Expiry” provides the additional expiry information, an alert @orange dot is also visible
1.2 Password workspace with expired resource activity (source figma)
Admin settings
Automatic workflows
In the administration workspace, A new “Password Expiry” section is available.
Password Expiry is by default disabled and it can be enabled via a toggle button.
Once enabled, password expiry will automatically trigger 2 workflows:
- Automatic expiry: when a user or a group is removed from the permission list and had access to the secret, the corresponding resource is automatically set to expired
- Automatic update: when the owner of a resource changes its secret, the expiry is automatically reset to the default value. For Passbolt CE, the default value is “never”.
Fig. 1.3.1 - Admin Settings - Password Expiry on (source figma)
Notification settings
In the email Email notification section, a new option is available to notify the owners when a password has expired and that they need to change it.
Fig. 1.3.3 - Admin Settings - Email notifications (source figma)
Email content
Password is going to expire or just expired
PRO only
Sent by cron job only
Sent to all resource owners
Sent if a resource is expired in exactly N days, or exactly today
See element Email/module/avatar_anonymous_text.
Email setting: send_password_aboutToExpire
Title/Subject: You have passwords requiring your attention
Avatar: You have passwords requiring your attention
Title: You have been requested to change them
Date: Now
Content:
- Passwords are going to expire you need to change them <- if some passwords are going to expire
- Passwords are expired you need to change them <- if some passwords are expired
- Change them in passbolt
Password is marked expired
The email setting is saved under the name: send_password_expire.
Sent by update expiry date (so-called) entry point or create resource entry point or update entry point
If the resource is expired, and the resource was already expired: send no email.
If the resource is expired, and any other meta data is edited: 2 emails are sent, this one, and the one about password creation.
This email is sent to all resource owner
The email requires a digest
Avatar: Admin (admin@passbolt.com)
Title/Subject: Admin marked the password {0} as expired
Content:
- Admin marked the password {0} as expired and you need to change it
- Change it in passbolt
A user changed the accesses of a password[a]
Sent to all password owners
Similarly for :
- User has been removed from a group and lost access to shared resources
- User has lost access to a shared resource
- User has been deleted (?disabled)
- Group has been deleted (?disabled)
Avatar: Some of your passwords expired
Title: You have been requested to change them
Content:
- Access for users to your shared passwords have been revoked. . These passwords are now marked as expired. Please rotate them to ensure continued security.
- Change it in passbolt
Example of email
Fig. 1.4.1 Email notification (source figma)
Email digest
An owner of a password is notified via a single email when multiple resources need to be changed at the same time.
High level requirements and Wireframes for Passbolt Pro
Figma file: https://www.figma.com/file/LbIziirnbUjSP4EWQMwky4/Password-Expiry?node-id=46%3A130
The Passbolt Pro version of password expiry has the same features as Passbolt CE with these additional features:
- Password expiry policy
- Default expiry period, an expiry date is automatically added when a resource is created
- Policy override option, users can change the expiry date of a resource manually.
- Expiry notifications, notifications are sent before the expiry date.
Resource workspace
Users must be able to view the expiry time of each resource in the grid
Expired record dates for less than a week are shown with @dark-red colour and an alert @orange dot, to put a visual emphasis that an action is needed.
Fig. 2.2.1 Password workspace with expiry dates (source figma)
Users can right click on a resource to set an expiry date or mark a resource as expired.
Fig. 2.2.2 Password workspace and contextual menu (source figma)
Users can do the same via the “more” contextual menu.
Fig. 2.2.3 Password workspace more menu (source figma)
Password expiry dialog
Depending on the organisation policy, users can modify the expiry date of a resource.
When users select “Set expiry date” in the right click or more menu, a new dialog is prompted.
Users can choose between 3 options:
- Renew the expiry date: the default expiry period is suggested but users can change it via the input number arrows or type the desired value (in days);
- Date field: users can type the desired date or select one via the default html date input;
- Never: users can remove the expiry date of a resource;
Fig. 2.2.4 Expiry dialog (source figma)
Admin settings
Password policy
In the administration workspace, A new “Password Expiry” section is available.
Password Expiry is by default disabled and it can be enabled via a toggle button.
In this section, an administrator can view the policy with two main options:
- Expiry policy
- Default password expiry period: an expiry date is automatically added when a resource is created;
- Policy override, users can change the expiry date of a resource manually via the expiry dialog;
- Automatic workflows: same as the Passbolt CE version, the only difference is when users change a secret, the expiry date is reset to the default value defined by the policy;
- Expiry notifications, notifications are sent before the expiry date and administrators can decide when the notification is sent before the expiry.
Fig. 2.3.1 - Admin Settings - Password Expiry (source figma)
Note: both “Policy override” & “Automatic Update” options cannot be disabled at the same time. Otherwise users wouldn’t be able to change the expired status on a resource.
Notification settings
In the email Email notification section, a new option is available to notify the owners when a password has expired or is about to expire and they need to change it.
Fig. 2.3.2 - Admin Settings - Email notifications (source figma)
Note: If the “When the password is about to expire, notify the owners to change it.” option is disabled by an administrator, then the “Expiry notification” setting is not visible in the “password expiry” section.
Email content
Single email
An owner of a password is notified via email when secrets are about to expire.
Fig. 2.4 Email notification (source figma)
The other email notifications are the same as Passbolt CE.
All the notifications can be merged in an email digest if the behaviour is allowed.
User stories for Passbolt CE
Variables
Resource expired wrapper component
| Resource expired wrapper component |
| Grid |
| Resource details sidebar |
As a user I can see the resource expiry status●
As a logged in user on the password workspace I can see the expiry column in the grid●
Given I am a logged in user
And The password expiry plugin is enabled with default settings
When I go to the password workspace
Then I see the “Expiry” column in the grid
When I click on the “columns” action button
Then I see the “Expiry” list item with a checkbox
As a logged in user on the password workspace I shouldn’t see the expiry column in the grid if the plugin is disabled●
Given I am a logged in user
And The password expiry plugin is disabled
When I go to the password workspace
Then I do not see the “Expiry” column in the grid
When I click on the “columns” action button
Then I do not see the “Expiry” list item with a checkbox
As a logged in user on the password workspace I can customise the grid with the expiry column●
Given I am a logged in user on the password workspace
And The password expiry plugin is enabled with default settings
When I hide the “Expiry” column in the “columns” action
Then I do not see the “Expiry” column in the grid
When I show the “Expiry” column in the “columns” action
Then I do see the “Expiry” column in the grid
As a logged in user on the password workspace I can see in the grid’s expiry column the resources expiry status●
Given I am a logged in user
And The password expiry plugin is enabled with default settings
When I go to the password workspace
And I see in the grid’s expiry column the <Resource> <Expired> status
And I see in the grid’s attention column warning me when the <Resource> is expired
| Resource | expired |
| expired | 3 months ago |
| not expired | Never |
| about to expire | in 2 weeks |
As a logged in user on the password workspace I can sort resources by expiry●
Given I am a logged in user on the password workspace
And The password expiry plugin is enabled with default settings
And The <Resource> are available
When I click on the “Expiry” column title
Then I see the resources are sorted by expiry status in ascending order
When I click on the “Expiry” column title again
Then I see the resources are sorted by expiry status in descending order
| Resource | expired |
| expired | 3 months ago |
| not expired | Never |
| about to expire | in 2 weeks |
As a logged in user on the password workspace I can see in the resource sidebar the resources expiry status●
Given I am a logged in user on the password workspace
And The password expiry plugin is enabled with default settings
When I click on the resource <Resource>
Then I see in the attention warning on the resource information section when the <Resource> is expired
And I see <expired> as value of the “Expiry” information item
And I see an attention warning next to the “Expiry” information label
| Resource | expired |
| expired | 3 months ago |
| not expired | Never |
| about to expire | in 2 weeks |
As a logged in user on the password workspace, I can see see expiration activity in the activity logs●
Given I am a logged in user on the password workspace
And The password expiry plugin is enabled with default settings
When I click go to the activity logs of a resource that had expired in its lifetime
Then I see in the activity logs the resource <expiry reason>
| Resource | expiry reason |
| scheduled expired | Ada scheduled the resource to expire on Y-M-D |
| lost perm. | Ada marked the resource as expired after changing the resource permissions |
| removed from group | Ada marked the resource as expired after updating the group members of Accounting[j] |
| delete user | Ada marked the resource as expired after deleting the user Betty H |
| delete group | Ada marked the resource as expired after deleting the group Accounting |
As a logged in user on the password workspace I can filter the grid by expired resources●
Given I am a logged in user on the password workspace
And The password expiry plugin is enabled with default settings
When I click on the “Expired” filter on the left sidebar
Then I can see the grid filtered by resources that are expired
And I can’t see the one that are not expired
As a user I can mark resources as expired automatically●
As a resource owner when I remove the direct and only access of a user to a shared resource then the resource is marked as expired●
Given I am a logged in user on the password workspace
And The password expiry plugin is enabled with default settings
And A user has a direct and only access to a resource it consumed the secret
When I remove the user from the permission list
Then I can see the resource is marked as expired in <Resource expired wrapper component>
And I see the resource expiry date has changed to “just now” in <Resource expired wrapper component>
As a resource owner when I remove the inherited and only access of a user to a shared resource then the resource is marked as expired●
Given I am a logged in user on the user workspace
And The password expiry plugin is enabled with default settings
And I am a group manager
And Some resources are shared with this group
And A member of this group only has access to the resources via the group
When I remove the user from the group
And I go to the password workspace
Then I can see the resources the group has access are marked as expired in <Resource expired wrapper component>
And I see the resources expiry date has changed to “just now” in <Resource expired wrapper component>
As an administrator when I delete a user from the organisation, the remaining shared resources the user accessed the secret are marked as expired ●
Given I am a logged in administrator on the user workspace
And The password expiry plugin is enabled with default settings
When I delete a user who had access to secret of shared resources
And I go to the password workspace
Then I can see the resources the user had access are marked as expired in <Resource expired wrapper component>
And I see the resource expiry date has changed to “just now” in <Resource expired wrapper component>
As a user I can reset resource expiry date●
As a logged in user when I edit the password of an expired resource then the resource shouldn’t be marked expired anymore●
Given I am a logged in user in the password workspace
And The password expiry plugin is enabled with default settings
When I edit an expired resource password
Then I see the resource not marked as expired in <Resource expired wrapper component>
And I see the resource expiry date has changed to “Never” in <Resource expired wrapper component>
Email notifications●
As a resource owner, I’m notified when a resource scheduled for expiry is expired●
Given I am a logged in user in my mail client
And The password expiry plugin is enabled with default settings
And The expiry email notification setting is enabled
When A resource scheduled for expiry just expired
Then I can see an email notification
And The email is prompting me to change the password
When I click on the “change password” link
Then I can see passbolt opening on a new window
And I can see the resource selected
As a resource owner, I’m notified when a resource is marked as expired following another user action●
Given I am a logged in user in my mail client
And The password expiry plugin is enabled with default settings
And The expiry email notification setting is enabled
When A resource is expired for <Expiry reason>
Then I can see an email notification with the <Origin action>
And The email is prompting me to change the passwords
When I click on the “change passwords” link
Then I can see passbolt opening on a new window
And I can see the grid filtered by “expired”
| Expiry reason | Origin action |
| scheduled expired | Ada scheduled the resource to expire on Y-M-D |
| lost dir. Or in. perm.| Ada marked resources as expired after changing the resource permissions |
| removed from group | Ada marked resources as expired after updating the group members of Accounting[k] |
| delete user | Ada marked resources as expired after deleting the user Betty H |
| delete group | Ada marked resources as expired after deleting the group Accounting |
As a user I can receive an email digest when several secrets need to be changed.●
Given I am a logged in user in my mail client
And The password expiry plugin is enabled with default settings
And email notification settings are enabled
And email digest is enabled
When Multiple resources I own are expired at the same time
And The number of resources overtake the digest threshold
Then I can see an email notification digest
And The email is prompting me to change the passwords
When I click on the link
Then I can see passbolt opening on a new window
And I can see the grid filtered by “expired”
As an administrator I can set the resource expiry email notification●
Given I am a logged in administrator on the administration workspace
And The password expiry plugin is enabled with default settings
When I click on “Email notification” settings
Then I see the “When the password is expired, notify the owners to change it.”
And I see the email notification is enabled by default
As an administrator I can enable password expiry ●
As an administrator I can enable password expiry settings●
Given I am a logged-in user on the administration workspace
And The password expiry flag is enabled
And The password expiry settings are disabled
And The password expiry policies flag is disabled
When I click on “Password expiry” in the left side menu
And I see a page with a “Password expiry” toggle
And the toggle button is not checked by default
And I see a description of the password expiry feature
When I check the “Password expiry” toggle
Then I don’t see anymore the expiry feature description
And I see the an “Automatic workflows” section
And I see an “Automatic expiry” card
And I see an “Automatic update” card
When I click save
Then I can see the settings have been saved
As an administrator I can delete automatic expiry renewal when users change their secrets●
Given I am a logged-in user on the password expiry settings page
And The password expiry flag is enabled
And The password expiry settings are enabled
And The password expiry policies flag is disabled
When I uncheck the “Password expiry” toggle
Then I should see a warning “Don't forget to save your settings to apply your modification.”
And I should not see the “Automatic workflows” section
And I see a description of the password expiry feature
When I click save
Then I can see the settings have been saved
User stories for Passbolt EE
As a user I can see the resource expiry status●
As a logged in user on the password workspace I can see in the grid’s expiry column when resources are going to expire[l] ●
Given I am a logged in user
And The password expiry policies plugin is enabled
And A resource expiry date is below the expiry notification threshold
When I go to the password workspace
And I see in the grid’s attention column warning me that the resource is going to expire
When I mouse hover the attention column warning
Then I see a tooltip explaining me the reason “The resource is going to expire in PERIOD”
As a logged in user on the password workspace I cannot see in the grid’s expiry column when resources are going to expire if the password expiry policies are disabled ●
Given I am a logged in user
And The password expiry settings plugin is enabled
And The password expiry policies flag is disabled
And A resource expiry date is below the expiry notification threshold
When I go to the password workspace
And I don’t see in the grid’s attention column a warning associated with the resource
As a signed-in user creating a resource from the app I should set the expired date if default expiry period has been defined in the organisation policies●
Given I am a logged in user
And The password expiry settings plugin is enabled
And The password expiry policies flag is enabled
And The password expiry policies is configured such that the default expiry period is set to 15 days
When I create a new resource
And I go back to the password workspace
Then I can see the new resource
And I can see “in 15 days” in In its expiry column
As a user I can change the expiry date of a resource automatically●
As a logged in user when I change a password it renews the expiry date ●
Given I am a logged in user on the password workspace
And The “Default expiry password period” policy is set to 365 days
When I edit a resource password
Then I see the resource expiry date set in the future in 365 days in the <Resource expired wrapper component>
Set expiry dialog●
As a logged in user in Passbolt EE, I can trigger the password dialog●
Given I am a logged in user in Passbolt EE on the password workspace
And the “Policy override” option is enabled
When I right click on a resource
Then I see the “Set expiry date” option in the contextual menu
When I click on the “Set expiry date” option
Then I see the “Password Expiry” dialog
When I select a resource
And I click on the more button
Then I see the “Set expiry date” option in the contextual menu
When I click on the “Set expiry date” option
Then I see the “Password Expiry” dialog
As a logged in user in Passbolt EE, I can trigger the password dialog for multiple resources using the action menu.●
Given I am a logged in user in Passbolt EE on the password workspace
When I select multiple resources that I can update that are expired
And I click on the more button in the action bar
Then I can see the “Set expiry date” option
When I click on the “Set expiry date” option
And I see the “Password Expiry” dialog
As a logged in user in Passbolt EE, I see Password expiry dialog●
Given I am a logged in user in Passbolt EE the “Password Expiry” dialog
When I am in the “Password Expiry” dialog
Then I see the “Password Expiry” title
And I see a cross button new to the title
And I see the “Set expiry date” section title
And I see a list of 3 option cards with radio buttons
And I see the first option has text and a number input field
And I see the second option has datetime input field
And I see the third option has the text “never”
And I see the footer with a cancel link and a save button
As a logged in user in Passbolt EE, I can optionally change the expiry date of a resource●
Option 1: with duration in days●
Given I am a logged in user in Passbolt EE on the password expiry dialog
When I click on the first option
Then I see the radio button and the border turn @blue
When I click on the arrows in the number input field
Then I see the number increasing or decreasing
When I type a number in the number input field
Then I see the number written in the field
When I type a character which is not a number in the number input field
Then I do not see the character in the field
When I click on the save button
Then I see the expiry date of the resource has changed in the grid
And I see the expiry date is postponed by the number input field in days
Option 2: with a date picker●
Given I am a logged in user in Passbolt EE on the password expiry dialog
When I click on the second option
Then I see the radio button and the border turn @blue
And I can see a datetime input field
When I click on the datetime input field
Then I see a calendar
And I pick a day in the calendar
When I click on the save button
Then I see the expiry date of the resource has changed in the grid
And I see the expiry date is postponed to the day selected in the calendar
Option 3: set to never●
Given I am a logged in user in Passbolt EE on the password expiry dialog
When I click on the third option
Then I see the radio button and the border turn @blue
And I can see a text “never”
When I click on the save button
Then I see the expiry date of the resource has changed in the grid
And I see the expiry date is set to never
Cancel●
Given I am a logged in user in Passbolt EE on the password expiry dialog
When I click on the cancel link
Then I see the resource in the grid
And I do not see any modification on the expiry date
As a user on the password workspace I see expiry info in the resource sidebar.●
Given I am a logged in user on the password workspace
And resources I have access to resources that are expired
When I click on a resource
Then I see the resource sidebar
And I see the “Expiry” with the date in friendly format
When I click on a resource that is not expired
Then I see the “Expiry” set to “Never”
As a logged in user in Passbolt EE on the password workspace, I can see in the information right sidebar when a resource expires.●
Given I am a logged in user on the password workspace
When I click on a resource that can expire
And I click on the “information” action button
Then I see the resource right sidebar
And I see the “Information” section
And I see an “Expiry” list item
And I see the “Expiry” with the date in friendly format
Quickly/multi mark as expired/reset expiry●
As a logged in user in Passbolt EE on the password workspace I can mark one resource as expired using the contextual menu.●
Given I am a logged in user in Passbolt EE on the password workspace
When I select a resource that I can update that is not expired
And I right click on the resource
Then I can see the contextual menu
And I see “Mark as expired” in the menu
When I select “Mark as expired”
And I see the “Expiry” column in the grid set to “Just now”
And I see the “Expiry” in the resource sidebar set to “Just now”
As a user on the password workspace I can mark one or more resources as expired using the action menu.●
Given I am a logged in user in Passbolt EE on the password workspace
When I select multiple resources that I can update that is not expired
And I click on the more button in the action bar
Then I can see the “Mark as expired” option
When I click on the “Mark as expired” option
And I see the “Expiry” date as been updated to “Just now”
Import / Export●
As a user on the password workspace I can import password expiry date from KDBX files.●
Given I am a logged in user on the password workspace
And I have a KDBX file with three resources one expired, one not expired and one where the expiry date is not set
When I import the KDBX file
Then I can see the resource that is not expired in the grid
And I can see the resource that is expired in the grid
And I can see the resource that have expiry date not set in the grid
As a user on the password workspace I can export password expiry dates from KDBX files.●
Given I am a logged in user on the password workspace
And I own three resources one expired, one not expired and one where the expiry date is not set
When I selected the resources
And I export the resources as KDBX file
And I open the file in Keepass
Then I can see the resource that is not expired in the grid
And I can see the resource that is expired in the grid
And I can see the resource that have expiry date not set in the grid
Email notifications ●
As an administrator I can set email notification on resource expiry●
Given I am a logged in administrator on the administration workspace
When I click on “Email notification” settings
Then I see the “password” section a notification
And I see the “When the password is expired, notify the owners to change it.”
And I see the “When the password is about to expire, notify the owners to change it.”
And I see the email notification is on by default.
Administration settings ●
As an administrator I can set when automatic expiry is triggered●
Given I am a LADEE on the administration workspace
When I click on “Password expiry” in the left side menu
And I see a page with a “Password expiry” toggle
And the toggle button is off by default
When I click on the toggle button
Then the “Password expiry” is on
And I see the “password expiry settings” form
And I see a page with a “Expiry policies” section
And I see a toggle button “Default password expiry period”.
And the toggle button is on by default
And I see a number input field
When I click on the arrows in the number input field
Then I see the number increasing or decreasing
When I type a number in the number input field
Then I see the number written in the field
When I type a character which is not a number in the number input field
Then I do not see the character in the field
When I click on the toggle button
And I click save
Then I can see the settings have been saved
As an administrator I can set when users can override the expiry policy●
Given I am a logged in administrator in Passbolt EE on the administration workspace
When I click on “Password expiry” in the left side menu
And the “Password expiry” toggle button is on
Then I see a page with a “Expiry policies” section
And I see a toggle button “Policy override”.
And the toggle button is on by default
When I click on the toggle button
And the “Automatic Expiry” is on
Then I see the “Policy override” toggle button is off
When I click on the toggle button
And the “Automatic Expiry” is off
Then I see the “Policy override” toggle button is still on
When I click save
And I go on a different workspace
And I go back to the “Password expiry” page of the administration workspace
Then I can see the settings have been saved
As an administrator I can set an automatic expiry when users or groups are removed from a permission list●
Given I am a logged in administrator in Passbolt EE on the administration workspace
When I click on “Password expiry” in the left side menu
And the “Password expiry” toggle button is on
Then I see a page with a “Automatic workflows” section
And I see a toggle button “Automatic Expiry”.
And the toggle button is on by default
When I click on the toggle button
And the “Policy override” is toggle button is on
Then I see the “Automatic Expiry” toggle button is off
When I click on the toggle button
And the “Policy override” is off
Then I see the “Automatic Expiry” toggle button is still on
When I click save
And I go on a different workspace
And I go back to the “Password expiry page of the administration workspace
Then I see the settings have been saved
As an administrator I can set an automatic expiry renewal when users change their secrets●
Given I am a logged in administrator in Passbolt EE on the administration workspace
When I click on “Password expiry” in the left side menu
And the “Password expiry” toggle button is on
Then I see a page with a “Automatic workflows” section
And I see a toggle button “Automatic update”.
And the toggle button is on by default
When I click save
And I go on a different workspace
And I go back to the “Password expiry page of the administration workspace
Then I can see the settings have been saved
As an administrator I can set a time before sending a notification when a resource is about to expire●
Given I am a logged in administrator in Passbolt EE on the administration workspace
When I click on “Password expiry” in the left side menu
And the “Password expiry” toggle button is on
Then I see a page with a “Expiry notification” section
And I see number input field
When I click on the arrows in the number input field
Then I see the number increasing or decreasing
When I type a number in the number input field
Then I see the number written in the field
When I type a character which is not a number in the number input field
Then I do not see the character in the field
When I click save
And I go on a different workspace
And I go back to the “Password expiry page of the administration workspace
Then I can see the settings have been saved
Security considerations
Risk analysis ●
Risk | Mitigation strategy |
User can override expiry without actually changing password | |
White paper update needed.
Data format
The settings manipulated by the API and the clients will be as follow
Password expiry settings format ●
Field | Is required | Type | Max size | Default value | Additional Validation |
defaul_expiry_period | No | int | N/A | 90 | Minimum: 1 |
policy_override | No | bool | N/A | false | |
automatic_expiry | Yes | bool | N/A | true | |
automatic_update | Yes | bool | N/A | true | |
expiry_notification | No | int | N/A | 2 | Minimum: 1 |
Resource format (update) ●
We propose to introduce an additional field “expired” to the data model on resources.
Field | Is required | Type | Max size | Default value | Additional Validation |
expired | No | Datetime | null | N/A | null |
API Specifications
GET /settings.json (updated) ●
GET /settings.json
Authentication: Authenticated users only
Response
Success - plugin enabled
200 OK
{
"header": {
"id": "fb1cdd6d-19d3-4ced-babc-e2b2008f2905",
"status": "success",
"servertime": 1670847378,
"action": "fb1cdd6d-19d3-4ced-babc-e2b2008f2905",
"message": "The operation was successful.",
"url": "/settings.json",
"code": 200
},
"body": {
"passbolt": {
"plugins": {
"passwordExpiry": {
"version": "1.0.0",
"enabled": true
},
"passwordExpiryPolicies": {
"version": "1.0.0",
"enabled": true
}
}
}
}
}
Success - plugin disabled
200 OK
{
"header": {
"id": "fb1cdd6d-19d3-4ced-babc-e2b2008f2905",
"status": "success",
"servertime": 1670847378,
"action": "fb1cdd6d-19d3-4ced-babc-e2b2008f2905",
"message": "The operation was successful.",
"url": "/settings.json",
"code": 200
},
"body": {
"passbolt": {
"plugins": {
"passwordExpiry": {
"version": "1.0.0",
"enabled": false
},
"passwordExpiryPolicies": {
"version": "1.0.0",
"enabled": false
}
}
}
}
}
POST /password-expiry/settings.json (new) ●
This endpoint is used by an administrator to create or update the “password expiry” settings.
Request
POST /password-expiry/settings.json
Authentication: Admin only
{
"default_expiry_period": 90,
"policy_override": false,
"automatic_expiry": true,
"automatic_update":true,
"expiry_notification_period": 2,
}
Response
Success
200 OK
{
"header": {
"id": "2192615a-4eec-4e8f-b9b1-4614edacd6c0",
"status": "success",
"servertime": 1634823645,
"action": "50ca4a19-b782-5842-bd2b-f59e9ff4eef9",
"message": "The operation was successful.",
"url": "/password-expiry/settings.json",
"code": 200
},
"body": {
"id": <uuid>,
"default_expiry_period": 90,
"policy_override": false,
"automatic_expiry": true,
"automatic_update":true,
"expiry_notification_period": 2,
"created": <datetime>,
"modified": <datetime>,
"created_by": <uuid>,
"modified_by": <uuid>
}
}
Error
- 404 if plugin is disabled
- 401 if user is not logged in
- 403 if user is not an administrator
- 400 if the request data or settings could not validate
GET /password-expiry/settings.json (new) ●
This endpoint returns the current password expiry settings.
Request
GET /password-expiry/settings.json
Authentication: Authenticated users only
Response
Success
Request from CE
200 OK
{
"header": {
"id": "2192615a-4eec-4e8f-b9b1-4614edacd6c0",
"status": "success",
"servertime": 1634823645,
"action": "50ca4a19-b782-5842-bd2b-f59e9ff4eef9",
"message": "The operation was successful.",
"url": "/password-expiry/settings.json",
"code": 200
},
"body":{
"id": <uuid>,
"automatic_expiry": true,
"automatic_update":true,
"created": <datetime>,
"modified": <datetime>,
"created_by": <uuid>,
"modified_by": <uuid>
}
}
Request from PRO
200 OK
{
"header": {
"id": "2192615a-4eec-4e8f-b9b1-4614edacd6c0",
"status": "success",
"servertime": 1634823645,
"action": "50ca4a19-b782-5842-bd2b-f59e9ff4eef9",
"message": "The operation was successful.",
"url": "/password-expiry/settings.json",
"code": 200
},
"body":{
"id": <uuid>,
"default_expiry_period": 90,
"policy_override": false,
"automatic_expiry": true,
"automatic_update":true,
"expiry_notification_period": 2,
"created": <datetime>,
"modified": <datetime>,
"created_by": <uuid>,
"modified_by": <uuid>
}
}
Error
- 404 if plugin is disabled
- 401 if user is not logged in
- 403 if user is not an administrator
- 500 if the settings retrieved in database does not validate
DELETE /password-expiry/settings/<uuid>.json ●
Request
DELETE /password-expiry/settings/<uuid>.json Authentication: Admin only |
Response (settings on)
200 OK |
{ "header": { "id": "8eef56cd-224d-4328-b698-92cc1f15be0c", "status": "success", "servertime": 1634830577, "action": "bef9f3ca-86ef-5c6a-9b38-320e03ceb5df", "message": "The operation was successful.", "url": "/password-expiry/settings/<uuid>.json", "code": 200 }, "body": { } } |
Errors
Possible errors:
- 401 Not authorised if not logged in
- 403 Forbidden if user is not admin
- 404 The plugin is not enabled
- 404 Record not found
GET /resources/<uuid>.json (update) ●
Additionally to existing fields, the API will return the expiry date.
Request
GET /resources/<uuid>.json
Authentication: Authenticated users only
Response
Success
200 OK
{
"header": {
"id": "bc8a85a7-bde8-48d5-8749-827c9185db15",
"status": "success",
"servertime": 1554907370,
"title": "app_resources_view_success",
"action": "83bb8bd8-2006-5546-a3bb-9319ae6e8f9d",
"message": "The operation was successful.",
"url": "/resources/ecf0ed85-3bfc-5f45-b11d-74e9a86aa313.json",
"code": 200
},
"body": {
"id": "ecf0ed85-3bfc-5f45-b11d-74e9a86aa313",
"name": "Grogle",
"username": "gustave",
"uri": "http://fr.groland.wikia.com/wiki/Grogle",
"description": "",
"created": "2019-04-04T12:05:58+00:00",
"modified": "2019-04-08T09:16:09+00:00",
"expired": "2020-04-08T09:16:09+00:00",
"created_by": "f848277c-5398-58f8-a82a-72397af2d450",
"modified_by": "f848277c-5398-58f8-a82a-72397af2d450"
}
}
GET /resources.json (update existing entry point) ●
Same as for the read endpoint, the API will return the expiry date as part of the resource. Additionally we implement the following filters
Param | Description | Required | Type |
filter[is-expired] | Return only the resources where the expired date <= now. | No | Boolean |
Request
GET /resources.json?filter[is-expired]=1
Authentication: Authenticated users only
Response
Success
200 OK
{
"header": {
"id": "bc8a85a7-bde8-48d5-8749-827c9185db15",
"status": "success",
"servertime": 1554907370,
"title": "app_resources_view_success",
"action": "83bb8bd8-2006-5546-a3bb-9319ae6e8f9d",
"message": "The operation was successful.",
"url": "/resources/ecf0ed85-3bfc-5f45-b11d-74e9a86aa313.json",
"code": 200
},
"body": [
{
"id": "ecf0ed85-3bfc-5f45-b11d-74e9a86aa313",
"name": "Grogle",
"username": "gustave",
"uri": "http://fr.groland.wikia.com/wiki/Grogle",
"description": "",
"created": "2019-04-04T12:05:58+00:00",
"modified": "2019-04-08T09:16:09+00:00",
"expired": "2020-04-08T09:16:09+00:00",
"created_by": "f848277c-5398-58f8-a82a-72397af2d450",
"modified_by": "f848277c-5398-58f8-a82a-72397af2d450"
}
]
}
POST /resources.json (update existing entry point) ●
The create endpoint will support passing the expiry date as a parameter. It is possible to both give an expiry date in the past and the future. This will allow supporting multiple use cases.
Request
POST /resources.json?api-version=v2
{
"name": "<uuid>",
"resource_type_id": "<uuid>",
"expired": "<datetime>|null",
"secrets": [...]
}
Response
Success
200 OK
{
"header": {
"id": "bc8a85a7-bde8-48d5-8749-827c9185db15",
"status": "success",
"servertime": 1554907370,
"title": "app_resources_view_success",
"action": "83bb8bd8-2006-5546-a3bb-9319ae6e8f9d",
"message": "The operation was successful.",
"url": "/resources/ecf0ed85-3bfc-5f45-b11d-74e9a86aa313.json",
"code": 200
},
"body": {
"id": "ecf0ed85-3bfc-5f45-b11d-74e9a86aa313",
"name": "Grogle",
"username": "gustave",
"uri": "http://fr.groland.wikia.com/wiki/Grogle",
"description": "",
"created": "2019-04-04T12:05:58+00:00",
"modified": "2019-04-08T09:16:09+00:00",
"expired": "2020-04-08T09:16:09+00:00",
"created_by": "f848277c-5398-58f8-a82a-72397af2d450",
"modified_by": "f848277c-5398-58f8-a82a-72397af2d450"
}
}
Error - 400 Bad Request
{
"header": {
"id": "965c9f17-18ae-48fd-a36e-e42f04a30442",
"status": "error",
"servertime": 1554907648,
"title": "app_resources_add_error",
"action": "ad8bbc35-6435-538e-b1a7-80b87bcedb6a",
"message": "Could not validate resource data.",
"url": "\/resources.json",
"code": 400
},
"body": {
"expired": {
"_datetime": "A valid expiry date is required."
}
}
}
- 401 if user is not logged in
- 500 if the settings retrieved in database does not validate
- 400 if the request data or settings could not validate
- expired is not a valid date
PUT /resources/<uuid>.json (update existing entry point) ●
Similar to the resource create endpoint it is possible to update a resource with an expiry date.
See: POST /resources.json (update) ●
POST /password-expiry/resources.json ●
End point to set the expiry date of multiple resources.
This endpoint is available only with the password expiry policy enabled.[m]
Do we want to send email notifications to the users having permissions to the resources impacted?[n][o] If yes:
- Should we reuse the email template used when updating a resource? Or create a new email?
- The API should not send email notifications if the expiry date of a resource was not updated (if the expiry date in the DB is the same as the one in DB)
Request
POST /password-expiry/resources.json Authentication: Logged in user [ { "id": <UUID>, "expired": <DATE>|null }, { "resource_id": <UUID>, "expired": <DATE>|null }, … ] |
Response (settings on)
200 OK |
{ "header": { "id": "8eef56cd-224d-4328-b698-92cc1f15be0c", "status": "success", "servertime": 1634830577, "action": "bef9f3ca-86ef-5c6a-9b38-320e03ceb5df", "message": "The operation was successful.", "url": "/password-expiry/resources.json", "code": 200 }, "body": [ { "id": <UUID>, "expired": <DATE>|null, "created": <DATE>, "modified": <DATE>, "modified_by": <UUID>, "created_by": <UUID> }, … ] } |
Errors
Possible errors:
- 400 if the password expiry policies plugin is not enabled
- 400 if the password expiry settings are not set
- 400 if the policy override is disabled
- 400 if the user does not have EDIT permission to one of the resources
- 400 if one of the resource ids is not a UUID
- 400 if one of the dates is not valid or not after or equal to today
Resources share
The share endpoint does not change per se. However additional server side treatments are added to make sure records are expired and email notifications are sent when someone is removed from the permission list.
Group update
Similarly additional server side treatments are added to make sure records are expired and email notifications are sent when someone is removed from a group, if that group had access to shared secrets that is.
User delete
Similarly additional server side treatments are added to make sure records are expired and email notifications are sent when someone is deleted from the organisation.
User disable
Likewise to user delete.
Cakephp implementation
- Add feature flag to settings whitelist
- Add a migration to add a datetime expires field to the resource table, default null.
- Add resource index controller expired filter and order.
- Add resource find table/trait filter and order options.
- Add expired date logic when someone or a group is removed from a resource permission list (direct share, group membership, user delete).
- Add email notification when a resource is marked as expired.
- Add email digests when multiple resources are marked as expired.
- etc.
AppJS changes
- Add feature flag “canIUse” make sure it disabled when it’s not present or set to disabled (to allow easier cloud rollout)
- Add email notification setting
- etc.
Passbolt WebExtension
Front end
- Add feature flag “canIUse” make sure it disabled when it’s not present or set to disabled (to allow easier cloud rollout)
- Update create / update resource dialog
- Update dialog page and unit tests
- Add columns to grid
- Add multi-select actions
- Add new password policy section
- Add
- etc.
Background page
- Add feature flag as part of settings
- Update resource entity
- Update resource entity unit tests
- etc.
PUBLIC - CC BY-SA 3.0 /
[a]@cedric@passbolt.com do we want an email setting here? This would enable admins to deactivate this potential leak of sensitive information regarding user access.
_Assigned to cedric@passbolt.com_
[b]@vivien@passbolt.com We might need an expired filter in the left sidebar filters shortcut.
[c]That would be nice to take all expired passwords together!
[d]Should a user be able to mark a resource as expired if the resource is already expired? I'd say a user shouldn't be able, but if part of a bulk update, it shouldn't block the operation.
[e]Do we want to be that precise on the date? Do people want that precision? What are the consequences for the cloud?
[f]We decided to keep the precision only to the day, and iterate on demand if any.
@vivien@passbolt.com
[g]Behavior confirmation:
If automatic update is enabled & policy override is enabled too. We can result to a case where the automatic update overrides the overridden expired value
[h]- Default period policy for the new one only. Wireframes and text to update
- Automatic update should override the overridden user expiry date. Wireframes and text to update.
- Plugin disabled by default
- Expired set to null is considered as never.
[i]PosgreSQL should support infinity ('infinity'::timestamp). Cannot find anything regarding MySQL.
[j]internal link to group
[k]internal link to group
[l]@stephane@passbolt.com This story is not implemented. To discuss if we want it, and schedule time accordingly.
_Assigned to stephane@passbolt.com_
[m]Not sure. We have an issue as of today, CE users have no possibility to remove expiry date. Which could be a deadlock.
[n]@stephane@passbolt.com do we want additional email notifications there?
_Assigned to stephane@passbolt.com_
[o]We should already have email templates to notify users about expiry. @stephane@passbolt.com mentions email digest to group them, do we already have one for this kind of email?