Need to render password unusable after certain number of days

[Kali Obsum, modificado hace 6 años.]

We will be sending temporary passwords to users and we want this password to become unusable after a certain number of days.

The current functionality of setting password expiry only prompts the user to change the pw after it has expired, but that means they can still log in after they've changed the pw. Thus, it wouldn't work for our requirement.

Is there any out-of-the-box solution we can use to achieve what we want to achieve?

[Olaf Kock, modificado hace 6 años.]

Kali Obsum:

We will be sending temporary passwords to users and we want this password to become unusable after a certain number of days.

The current functionality of setting password expiry only prompts the user to change the pw after it has expired, but that means they can still log in after they've changed the pw. Thus, it wouldn't work for our requirement.

Is there any out-of-the-box solution we can use to achieve what we want to achieve?

There's nothing out of the box. You probably have to use the API to mark the users you're interested in (e.g. through a custom field),
fetch them by last login date and, if necessary, deactivate the account. Just changing the password to something unknown wouldn't work as they still might be able to reset it.
It's all programmable, available through the API. Sorry, there's no simple UI/checkbox for it.

[Kali Obsum, modificado hace 6 años.]

I see, thanks for the reply!

[Djamel TORCHE, modificado hace 6 años.]

Hi,
As Olaf Kock said, there is no out of the box solution for the moment in Liferay, but if you decide to do it by code, below a simple proposal that you can follow to achieve what you want in simple and clean way :
The first step, When creating you users that should be deactivated/deleted after some number of days, assign it a specific role (this to distinguish them later, call the role whatever, ex: USER_TO_DELETE_AFTER_XX_DAYS, or a custom field as Olaf Kock suggests), you can also put the XX_DAYS in server portal properties file to make it more dynamic.
Second step, create a service wrapper (for UserLocalServiceWrapper), then when a user try to authentificate, if he has USER_TO_DELETE_AFTER_XX_DAYS role, you can do whatever you want with user acount like as login failed or even delete it using UserLocalServiceUtil. Just find witch method to override, the simplest case is to override isPasswordExpired and return always true if user has USER_TO_DELETE_AFTER_XX_DAYS role. You have the createDate getter of the User object to detect if it exceeds the limit of XX_DAYS.

Kind regards,
Djamel

[Andrew Jardine, modificado hace 6 años.]

What about the option of sending them a password reset link instead of the temporary password? The reset link has a "ticket value" and I believe it can be set to expire. That way they have no idea (and don't need to know) what the temporary password is -- they click the link, and it takes them to the site and prompts them to set it. No custom code required -- just configuration (I think -- the only thing I am not sure of is the ticket expiration. I think it defaults to 24 hours)

Which version of Liferay are you using?

[Andrew Jardine, modificado hace 6 años.]

In both LR6.2 and LR7 there is a property --

passwords.default.policy.reset.ticket.max.age=86400

.. maybe that will suit your needs?

[Kali Obsum, modificado hace 6 años.]

Thanks