Force a password change

[MariusBluem]

We should offer an function to force password changes, in case of:

• a user is logging in for his first time (Force user to change password at first Login #1255)
• a security issue occurred, and the admin want to make a bulk password reset (force password change for all users by admin #1261)
• special outside policies like for example periodic password changes (Password expiration #8785)

In general this should also be provided via API to make it possible to integrate tools outside of Nextcloud.

cc @LukasReschke @Liwindo @hitam4450

[MorrisJobke]

Maybe implemented as password expiry in the password_policy app?

[Liwindo]

Not sure if that's enough. For my case you need also an option to lock the login until the passwords are changed in combination with an approval-mail to prevent that a stranger reset the password.

[kisimediaDE]

Are there some planes when this feature will integrate?

[MorrisJobke]

Are there some planes when this feature will integrate?

Once somebody implements it, because as of now it's only a request without any roadmap plans yet.

[MorrisJobke]

• special outside policies like for example periodic password changes (Password expiration #8785)

In general this should also be provided via API to make it possible to integrate tools outside of Nextcloud.

I added those two for the request in #8785

[KB7777]

Yes, API would be great :-)

[hex-m]

Regarding the API and external tools that could change passwords I'd like to point to this discussion.

It seems to me like the "force reset password on next login"-feature is a different issue than the API.

[pierreozoux]

Currently, if you use vanilla Nextcloud (without any apps), it is really unsecure. When you create a user, you then have to send the password to this user, and the way people do it is via email.
And as you know users, they never change their password.

You can of course mitigate that with the registration app, or any user backend, but for vanilla users, it is unsecure.

[Nils160988]

You don't have to set a password. You can just create the account, people receive an email with a link and set their own password.

[joshtrichards]

Related: nextcloud/password_policy#14