Bug 21187 - GDPR: Regularly force patrons password renew
Summary: GDPR: Regularly force patrons password renew
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: unspecified
Hardware: All All
: P2 enhancement (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-08-09 13:25 UTC by Vitor Fernandes
Modified: 2023-10-02 21:22 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Vitor Fernandes 2018-08-09 13:25:56 UTC
Under the auspices of the recently issued European legislation regarding data privacy (GDPR), the Portuguese government has issued a series of mandatory requirements, as well as general recommendations, for software applications that are implemented under the umbrella of public bodies (RCM 41/2018).

Since Koha is mostly used by municipalities and universities in Portugal, some of these mandatory requirements need to be address by Koha implementers in Portugal.

We believe that this requirement is also useful for the community at large. Here’s a description of the requirement.

*** Requirement description ***

The application MUST ensure that the user changes his password frequently. If the user doesn’t change is password it should be impeded from using the application until he does so.

Having a setting where one can define the number of days until a password becomes invalid is necessary. The recommendation is 6 months for standard users, and 3 months for administrators.

*** Scope ***

Only applicable for passwords managed by Koha. When using a centralized authentication system, this task should be managed by the central authentication system.
Comment 1 Marjorie Barry-Vila 2020-01-06 20:53:59 UTC
+1
Comment 2 Katrin Fischer 2020-04-05 10:33:08 UTC
I know that some security related agencies have revoked the recommendation to change the passwords frequently, but it might vary. Maybe this development could also lead to a 'password change on first login' feature at the same time (bug 24795)