Password Policies

Password policies enforce security requirements for user passwords. Each tenant can configure its own policy defining minimum complexity, maximum age, and history constraints.

The PasswordPolicy entity stores per-tenant password rules:

The PasswordHistory table stores hashed versions of previous passwords. When a user changes their password, the service checks the history:

// Check against last N passwords
List<PasswordHistory> history = passwordHistoryRepository
    .findTopNByUserIdOrderByCreatedAtDesc(userId, policy.getHistoryCount());
 
for (PasswordHistory ph : history) {
    if (passwordEncoder.matches(newPassword, ph.getPasswordHash())) {
        throw new BusinessException("Password was used recently");
    }
}

The PasswordExpirationService checks whether a user's password has exceeded the maximum age:

• user.passwordChangedAt tracks when the password was last changed
• If now - passwordChangedAt > maxAgeDays, the user is prompted to change their password
• The PasswordExpirationService can be invoked during login to enforce mandatory password rotation

Related Services