Fix Zitadel generated password complexity requirements - #1589
Open
afscrome wants to merge 2 commits into
Open
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Add a deterministic test verifying all four required character classes.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Updates Zitadel’s generated admin password to require lowercase, uppercase, numeric, and special characters.
Changes:
- Strengthens default password generation requirements.
File summaries
| File | Summary |
|---|---|
src/CommunityToolkit.Aspire.Hosting.Zitadel/ZitadelHostingExtensions.cs |
Applies complete password complexity constraints. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
|
||
| var usernameParameter = username?.Resource ?? new ParameterResource($"{name}-username", _ => "admin", false); | ||
| var passwordParameter = password?.Resource ?? ParameterResourceBuilderExtensions.CreateDefaultPasswordParameter(builder, $"{name}-password", minSpecial: 1); | ||
| var passwordParameter = password?.Resource ?? ParameterResourceBuilderExtensions.CreateDefaultPasswordParameter(builder, $"{name}-password", minLower: 1, minUpper: 1, minNumeric: 1, minSpecial: 1); |
afscrome
enabled auto-merge
September 12, 2026 12:48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Zitadel can fail during initial setup when its generated admin password contains no digits. Require at least one lowercase letter, uppercase letter, digit, and special character when generating the default password.
Aspire defaults
minLower,minUpper, andminNumericto zero; enabling those character classes does not guarantee their presence. The integration previously specified onlyminSpecial: 1.Failure evidence
The failed GitHub Actions job in run 34691146787, observed on #1588, reported 7 failed tests out of 31. Zitadel v4.15.0 logged:
The tests then failed with:
The log excerpts above omit unrelated fields with
.... The existing database dependency already calls.WaitFor(database), and the failing tests already wait for Zitadel to become healthy. The setup failure requires a password-generation fix.Validation
ZitadelHostingExtensionsTests(including the new password regression test) withdotnet run --project tests/CommunityToolkit.Aspire.Hosting.Zitadel.Tests --configuration Release -- --filter-class '*ZitadelHostingExtensionsTests'.Container runtime 'docker' was found but appears to be unhealthy). Container validation remains for CI.git diff --checkpassed.PR Checklist
The regression test inspects all four generation minima and validates a freshly generated password. It fails against the original minSpecial-only settings and passes with the fix. Publish mode exposes the generator directly without persisted user secrets.