Password Strength with Provisioning API

[JD McKeel]

I am unclear exactly what Google considers a "strong" password. Apart from the 8-character minimum, there does not seem to be a firm requirement.  I know that when manually resetting a password, Google Apps will not allow a weak password.

Here's my question:

Will a call to the Provisioning API fail if the password is weak?  We are planning to implement a synchronization solution soon, and I need to know whether this will be a problem.  The 8 character minimum is a given, and I know that will cause a fail, but what about the gray area of "weak" vs. "strong" passwords?

Any help or advice is much appreciated.

JD
Martinez Unified School District

[Claudio Cherubino]

Hi JD,

The Provisioning API will fail with InvalidPassword(1402) when you supply a weak password.

Claudio

--
You received this message because you are subscribed to the Google Groups "Google Apps Domain Information and Management APIs" group.
To view this discussion on the web visit https://groups.google.com/d/msg/google-apps-mgmt-apis/-/-dbF735PsP0J.
To post to this group, send email to google-app...@googlegroups.com.
To unsubscribe from this group, send email to google-apps-mgmt...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/google-apps-mgmt-apis?hl=en.

[JD McKeel]

Thanks for the response.  Can you tell me any more about what exactly constitutes a weak password so that I can set a matching password policy for my user directory?

>>> Claudio Cherubino <ccher...@google.com> 6/9/2011 9:44 AM >>>

-----------------------------------------------------------------------------------------------------

CONFIDENTIALITY NOTICE:

This message is intended only for the designated recipient(s). It may contain confidential or proprietary information and may be subject to the attorney-client privilege or other confidentiality protections. If the reader of this message is not the intended recipient, or an authorized employee or agent of the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited and may subject you to civil action and/or criminal prosecution. If you have received this communication in error, please notify us by replying to this message and deleting it from your computer and any network to which your computer is connected. Thank you.

-----------------------------------------------------------------------------------------------------

[NCCFred]

Claudio,

 

Will that happen if you Hash the password (MD5 or SHA1).  When I reset a password to a very simple six digit number I don't recall this happening - just wondering.  Maybe a work around for JD could be a password Hash to avoid a potential InvalidPassword(1402) error with a "weak" password?

 

Fred

[JD McKeel]

Thanks for that input, Fred. I didn't think to include this in my question.  We would plan to send over hashed passwords, not plain text.  Does this make a difference, Claudio?

>>> NCCFred <int...@ncc.edu> 6/9/2011 10:07 AM >>>

--
You received this message because you are subscribed to the Google Groups "Google Apps Domain Information and Management APIs" group.

To view this discussion on the web visit https://groups.google.com/d/msg/google-apps-mgmt-apis/-/pLK8G0FFBXkJ.

To post to this group, send email to google-app...@googlegroups.com.
To unsubscribe from this group, send email to google-apps-mgmt...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/google-apps-mgmt-apis?hl=en.

[David Haley]

Hi,

In general, for what makes Google consider passwords to be 'strong',
see:
https://www.google.com/accounts/PasswordHelp

and from this page,
http://www.google.com/support/a/bin/answer.py?answer=139399

there is the requirement that passwords must be at least 8 characters.

Cheers,
- David

On Jun 9, 10:13 am, "JD McKeel" <JDMcK...@martinez.k12.ca.us> wrote:
> Thanks for that input, Fred. I didn't think to include this in my question.  We would plan to send over hashed passwords, not plain text.  Does this make a difference, Claudio?
>

> >>> NCCFred <inti...@ncc.edu> 6/9/2011 10:07 AM >>>

>
> Claudio,
>
> Will that happen if you Hash the password (MD5 or SHA1).  When I reset a password to a very simple six digit number I don't recall this happening - just wondering.  Maybe a work around for JD could be a password Hash to avoid a potential InvalidPassword(1402) error with a "weak" password?
>
> Fred
>
> On Thursday, June 9, 2011 12:44:01 PM UTC-4, Claudio Cherubino wrote:
>
> Hi JD,
>
> The Provisioning API will fail with InvalidPassword(1402) when you supply a weak password.
>
> Claudio
>
> --
> You received this message because you are subscribed to the Google Groups "Google Apps Domain Information and Management APIs" group.

> To view this discussion on the web visithttps://groups.google.com/d/msg/google-apps-mgmt-apis/-/pLK8G0FFBXkJ.

> To post to this group, send email to google-app...@googlegroups.com.
> To unsubscribe from this group, send email to google-apps-mgmt...@googlegroups.com.

> For more options, visit this group athttp://groups.google.com/group/google-apps-mgmt-apis?hl=en.