UserInterfaceHook Plugin - CompromisedPasswordChecker

Requirements

Component	Version(s)	Link
PHP		PHP
ILIAS	to	ILIAS

---

Table of contents

• UserInterfaceHook Plugin - CompromisedPasswordChecker
  • Requirements
  • Table of contents
  • Installation
  • Supported forms/views
  • Usage

---

Installation

1. Clone this repository to public/Customizing/global/plugins/Services/UIComponent/UserInterfaceHook/CompromisedPasswordChecker
2. Install the Composer dependencies

   cd public/Customizing/global/plugins/Services/UIComponent/UserInterfaceHook/CompromisedPasswordChecker
   composer install --no-dev

   Developers MUST omit the --no-dev argument.
3. Login to ILIAS with an administrator account (e.g. root)
4. Select Plugins in Extending ILIAS inside the Administration main menu.
5. Search for the CompromisedPasswordChecker plugin in the list of plugin and choose Install from the Actions drop-down.
6. Choose Activate from the Actions dropdown.

Supported forms/views

• Changing password after initial user creation.
• Changing password through user profile settings.

Usage

1. Open the plugin configuration and switch to the Password-Lists tab.
2. Switch to the Upload sub-tab.
3. Choose between the available options, fill out the form and submit it.
4. You will be redirected back to the Overview sub-tab and a new password list will be available in the table.
5. Activate the new password-list.
6. If a user enters a password into a password field on the plattform. The entered password will be checked against all activated password-lists.
   If the password is found in a list. The password is denied and the user is shown an error message.

Notes

• Note that passwords are stored as plain text.
  • Since these passwords are considered "insecure" and the plugin does not act as a service for other applications to determine if a password is insecure (Like HIBP)
    and these passwords don't leave ILIAS this approach should be considered "acceptable".
  • It may be wise in the future to secure these passwords better
    • This would require a migration to move plain text passwords to a more secure (encrypted) approach.