<div dir="ltr">First thing would be to create PasswordPolicySPI, PasswordPolicyProviderFactory and PasswordPolicyProvider. PasswordPolicyProvider should have same methods as Policy. You'd then have to extract all built-in providers from PasswordPolicy into PasswordPolicyProvider implementations, this should be relatively straightforward as they are already "id" -> implementation, just means you retrieve it with KeycloakSession rather than hard-coded in PasswordPolicy. PasswordPolicy should then be change to use KeycloakSession to retrieve PasswordPolicyProvider instead of hard-coded Policy implementations.<div><br></div><div>Next step would be admin console integration. At the moment the list of policies is hard-coded it would need to get the list of policies from server-info instead. There are other bits that use server-info to list providers already so take a look at that. You would probably also need to add a method to PasswordPolicyProvider to return a description of the policy for the admin console tooltips.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 25 April 2016 at 18:36, Roelof Naude <span dir="ltr"><<a href="mailto:roelof.naude@gmail.com" target="_blank">roelof.naude@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>thank you all for the quick response.<br><br></div>do you guys have a basic idea on how to approach the policy spi? we are more than willing to help out to get it done. <br><br>maintaining a fork is maybe an option to resolve the immediate need, but would prefer to keep things upstream as much as possible.<br></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Apr 25, 2016 at 5:30 PM, Stian Thorgersen <span dir="ltr"><<a href="mailto:sthorger@redhat.com" target="_blank">sthorger@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">We an to introduce a password policy spi soon, but for now you're stuck with the built-in policies.</p><div><div>
<div class="gmail_quote">On 25 Apr 2016 16:43, "Bruno Oliveira" <<a href="mailto:bruno@abstractj.org" target="_blank">bruno@abstractj.org</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I believe we don't have an SPI for this, yet. See: <a href="https://issues.jboss.org/browse/KEYCLOAK-2824" rel="noreferrer" target="_blank">https://issues.jboss.org/browse/KEYCLOAK-2824</a>.<br>
<br>
IMO, Argon2 is completely new and aside from the bindings, we don't have<br>
a Java implementation, yet for this. I'm not sure if is a good idea to<br>
introduce C to the codebase, but totally doable to have an SPI for<br>
policies.<br>
<br>
On 2016-04-25, Roelof Naude wrote:<br>
> hi,<br>
><br>
> a client has requested the use of the argon2 [1, 2] password hashing<br>
> scheme. this can easily be added as an external provider. we do however<br>
> require custom password policies, e.g. memory / parallelism cost as well as<br>
> salt length. AFAIK there is no way to provide policy extensions using a<br>
> provider interface?<br>
><br>
> would argon2 be a worthwhile contribution?<br>
><br>
> regards<br>
> roelof.<br>
><br>
> [1] <a href="https://github.com/P-H-C/phc-winner-argon2" rel="noreferrer" target="_blank">https://github.com/P-H-C/phc-winner-argon2</a><br>
> [2] <a href="https://github.com/phxql/argon2-jvm" rel="noreferrer" target="_blank">https://github.com/phxql/argon2-jvm</a><br>
<br>
> _______________________________________________<br>
> keycloak-dev mailing list<br>
> <a href="mailto:keycloak-dev@lists.jboss.org" target="_blank">keycloak-dev@lists.jboss.org</a><br>
> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-dev" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a><br>
<br>
<br>
--<br>
<br>
abstractj<br>
PGP: 0x84DC9914<br>
_______________________________________________<br>
keycloak-dev mailing list<br>
<a href="mailto:keycloak-dev@lists.jboss.org" target="_blank">keycloak-dev@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-dev" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a><br>
</blockquote></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>