Policy error when resetting password, but policy correct and no error logged

[floridop]

Hi all
I am testing mokey and ran into this problem.
version: 0.6.6

After successfully initiating a password reset using a link sent via email, the password reset fails with error:

Password does not conform to policy. Try including both upper/lower case, numbers, and other characters

But, the password policy is correct and matches the one in ipa. For what matters here's the relevant config entries:

min_passwd_len = 12
min_passwd_classes = 4

What is odd is that nothing is logged on server side despite I have
MOKEY_ARGS="--config=/etc/mokey/mokey.toml --loglevel=debug" in /etc/default/mokey (this is Alma Linux)

I am using the rpm package from your builds.

Is there something I can provide to debug? I do not really understand where you do this validation, I can see in password.go that there is something there, but I suspect this is done in JavaScript on the password reset page.

Cheers,
Florido

[floridop]

I want to add that this only happens when the user initiates the password reset. When the password reset is initiated by the administrator on IPA, the change password form behaves as expected with the proper policy. So this is something odd on the password reset form maybe (/auth/resetpw/<code>)

[floridop]

Fiddling a bit with parameters:
min_passwd_classes = 5 yields the same error
min_passwd_classes = 3 returned instead "Something bad happened. Please contact site admin"
but no trace of any of these in the logs, and well I am the site admin...
... which is when I discovered that mokey was not configured correctly on the IPA side - so for anyone who ends up in this page, also check that the mokey service has the correct role. The misconfiguration was that using an alias in ipa role-add-member 'Mokey User Manager' --service=mokey/mokey as the instructions say did not work for me, I had to write the full principal name e.g. ipa role-add-member 'Mokey User Manager' --service=mokeymyservername@mydomain. Hints were in IPA logs (on my setup on /var/log/messages on the ipa server, search for user_mod: ACIError ) and not on mokey side, although I think the API might have returned the error.
But the issue with number of classes remains, keep reading below.

Coming back to the min_passwd_classes issue, I had to revert to min_passwd_classes = 3 and then it worked.
But I believe this is not correct. In fact I did some tests and the form validates against 4 different classes when it is set to 3 (lowercase, uppercase, numbers, symbols OR spaces) otherwise the password will not be accepted.

Where is the relevant code for this? It seems to me that it is some JavaScript library and not GO, but I am not good in web development. The only relevant thing I found is

mokey/server/password.go

Line 67 in ebf24c1

if numCategories < minClasses {

but the logic seems to be correct, because it doesn't change when minClasses is 3 or 4, unless numCategories is wrongly calculated in ways I cannot imagine. I checked against the regexp earlier in that code and they seem correct.

Maybe the types of classes are identified in a different way?

I think the problem is that the definition of these classes is confusing from the beginning.
According to IdM docs:
https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/pwd-policies-how#pwd-policies-attributes

The number of different character classes the user must use in the password. The character classes are:

Uppercase characters
Lowercase characters
Digits
Special characters, such as comma (,), period (.), asterisk (*)
Other UTF-8 characters 

This is quite misleading, because 0 means no classes but also any class, which basically means 0 and 1 have the same meaning - no class or at least one class is the same, if there is any password with any symbol at all. But of course when writing code 0 can mean run no checks at all.

A bit of digging reveals that these classes concepts might be taken from Kerberos definition which is different from mokey and IPA:

-minclasses number
Sets the minimum number of character classes required in a password. The five character classes are lower case, upper case, numbers, punctuation, and whitespace/unprintable characters.
(search for -minclasses at the link: https://web.mit.edu/kerberos/krb5-1.11/doc/admin/database.html )