checkId: check.users.password.policy plugin: stellaops.doctor.authority severity: warn tags: [authority, password, policy, security]

Password Policy

This Doctor check validates that the Authority Standard-plugin password policy meets baseline security requirements. It runs only when the Standard authentication plugin is enabled (LDAP/OIDC delegate password rules to the external directory). It is distinct from the Security plugin’s check.security.password.policy, which evaluates the platform-wide security posture.

What It Checks

Reads Authority:PasswordPolicy and evaluates:

• Minimum length (MinLength, default 8) — fails below the absolute minimum (8); recommends raising it toward 12.
• Complexity (RequireUppercase, RequireLowercase, RequireDigit, RequireSpecialCharacter) — recommends 3+ enabled requirements.
• Max age (MaxAgeDays) — flags very short rotation windows that frustrate users.
• Reuse prevention (PreventReuseCount, default 5) — recommends 5+.

Outcomes: fail on a length below the absolute minimum, warn when only recommendations apply, pass when the policy meets requirements.

Why It Matters

A weak password policy is a direct attack surface for credential-stuffing and brute-force attacks against local accounts. Because Authority is the platform’s identity gateway, a compromised local account can escalate into full release-control authority.

Common Causes

• Authority:PasswordPolicy:MinLength set below 8.
• Fewer than three complexity requirements enabled.
• Reuse prevention disabled or set very low.

How to Fix

Docker Compose

environment:
  Authority__PasswordPolicy__MinLength: "12"
  Authority__PasswordPolicy__RequireUppercase: "true"
  Authority__PasswordPolicy__RequireLowercase: "true"
  Authority__PasswordPolicy__RequireDigit: "true"
  Authority__PasswordPolicy__RequireSpecialCharacter: "true"

Bare Metal / systemd

Edit /etc/stellaops/appsettings.json:

{
  "Authority": {
    "PasswordPolicy": {
      "MinLength": 12,
      "RequireUppercase": true,
      "RequireLowercase": true,
      "RequireDigit": true,
      "RequireSpecialCharacter": true,
      "PreventReuseCount": 5
    }
  }
}

Kubernetes / Helm

authority:
  passwordPolicy:
    minLength: 12
    requireUppercase: true
    requireLowercase: true
    requireDigit: true
    requireSpecialCharacter: true
    preventReuseCount: 5

Verification

stella doctor run --check check.users.password.policy

Related Checks

• check.users.superuser.exists— verifies an administrator account exists
• check.security.password.policy — the Security plugin’s platform-wide password-policy posture