Kevin Reed (Springthrough) asked a question.
Does anyone know what conditions trigger this warning? What fields is is looking at? Can I turn this check off without turning off the other system status checks? I tried changing the min password length, but that didn't make it go away. This check doesn't seem to be mentioned in the documentation.
Hello Kevin,
Please follow this documentation article in order to configure the password requirements for Sitefinity: https://www.progress.com/documentation/sitefinity-cms/administration-set-password-requirements#configure-password-requirements .
Regards,
Ran into this today too after upgrading to 15.2. I needed to set minRequiredNonalphanumericCharacters, minRequiredPasswordLength, and provide a matching RegEx in passwordStrengthRegularExpression. Just adding this in as it seemed counter-intuitive to me to need to add a RegEx that does the the same thing.
I finally had some time to dig into this today. This message is triggered by Telerik.Sitefinity.Authentication.AuthenticationSystemStatusRetriever.
The "Password requirements not configured" message appears when any open access membership provider has an empty password strength regex.
The parameters are a little confusing to me because we also have minRequiredNonalphanumericCharacters, minRequiredPasswordLength, newPasswordLength parameters, but those don't seem to affect this warning.
There is also an "Insecure Authentication Provider" message that is shown when any enabled OpenID Connect authentication provider has a nonce mode of Disabled or Remote Only.
I'm ready to get rid of this warning message, frankly because it doesn't apply since we are using EntraID SSO in SF.
@Kevin Reed (Springthrough) what did you end up putting in the Value box? What's a minimal regex that can be used here?
Hi @Mark Mazelin (Cedarville University),
The site that triggered this question is already using minRequiredPasswordLength=8. Based on that requirement, I set passwordStrengthRegularExpression to "(?=.{8,})".
I finally had some time to dig into this today. This message is triggered by Telerik.Sitefinity.Authentication.AuthenticationSystemStatusRetriever.
The "Password requirements not configured" message appears when any open access membership provider has an empty password strength regex.
The parameters are a little confusing to me because we also have minRequiredNonalphanumericCharacters, minRequiredPasswordLength, newPasswordLength parameters, but those don't seem to affect this warning.
There is also an "Insecure Authentication Provider" message that is shown when any enabled OpenID Connect authentication provider has a nonce mode of Disabled or Remote Only.