CreateUser.aspx fails to create a password that is long enough to meet the minimum password length

SecureAuth Idp Version affected:  All

Description:  

The Create User post authentication page is creating an account but generates a password that is not long enough to meet the password policy if a password longer than 8 characters is required.  Due to not meeting the password policy it also fails to Enable the account because most common LDAP directories prevent accounts with an invalid password from being enabled.

Additionally, if Audit logging is enabled on the realm the following log entry can be observed:

 <UserID>firstname.surname@domain.com</UserID><Message>Create user</Message></Root>
<UserID>firstname.surname@domain.com</UserID><Message>Create user exiting with status: ProviderError</Message></Root>

Cause: 

Instead of using the PwdComplexLength key from the web.config as the Password Reset page does, the Create User page instead uses a hard coded value of 8 characters maximum password length.

Resolution:  

Addressed in hotfix 9.1.0.124 for version 9.1.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.