check_password_complexity()

Checks whether a password satisfies the password rule configured on the server. The server matches the password against the regular expression in Login\PwdComplexity and returns the verdict as a bool.

Typical use: validate a password before passing it to create_user(), update_user() or a self-service password change, so the user gets the server’s own verdict instead of a rejected write.

Despite the job name krn.VerifyPassword this is not a credential check: the password is never compared against the stored password of any account.

With a rule configured, even the correct password of the logged-in user returns false as soon as it does not match that rule. The method is therefore unsuitable for confirming a user’s identity (step-up authentication) - use check_user_account() for that.

1. Signature

  • Sync

  • Async

ecm.security.check_password_complexity(password: str) -> bool
await ecm.security.check_password_complexity(password: str) -> bool

2. Parameters

Parameter Default Description

password

required

The plaintext password to check (or an ECMIND_KEY-encrypted value, which is auto-decrypted via password_reveal()). It is encoded with the scheme the server requests (its Security\PwdDecryption setting) before being sent - exactly like create_user() does. A value that is already server-encoded is forwarded verbatim.

3. Return value

True when the password satisfies the configured rule, False otherwise.

4. Errors

Exception Cause

ValueError

password is empty (the server rejects empty values with an error, which the method catches before the roundtrip), or the password cannot be represented by the server’s scheme (e.g. more than 62 characters on a PwdDecryption=1 server).

ECMException

Subclass raised by raise_for_blue_exception on server failure.

5. Examples

5.1. Check a password before creating the account

  • Sync

  • Async

password = "S3cret!"

if not ecm.security.check_password_complexity(password):
    raise ValueError("password does not satisfy the server's password rule")

user = ecm.security.create_user("john", password=password, display_name="John Doe")
password = "S3cret!"

if not await ecm.security.check_password_complexity(password):
    raise ValueError("password does not satisfy the server's password rule")

user = await ecm.security.create_user("john", password=password, display_name="John Doe")

5.2. Read the rule description for the error message

Login\PwdComplexityDescription holds the text the administrator configured for the rule - that is, what the user should see when the check returns False:

from ecmind_blue_client import Jobs

if not ecm.security.check_password_complexity(password):
    hint = ecm.execute(Jobs.KRN_REGETREGVALUE, Flags=0, Name="Login\\PwdComplexityDescription")
    print(hint.get("Value", str, "password does not meet the requirements"))

6. Server-side settings

The rule is maintained in the enaio® enterprise-manager under the server properties, section Login, and lives in the server registry:

enterprise-manager Registry entry Meaning

Regular expression for the password syntax

Login\PwdComplexity

A regular expression prescribing the syntax for assigning and changing a password. A password that does not match it is not accepted. Default: empty.

Description text for the password syntax

Login\PwdComplexityDescription

The description of that rule, shown in the dialogs for assigning and changing a password. Default: empty.

So check_password_complexity() queries exactly the rule the server itself enforces when a password is set - and Login\PwdComplexityDescription is the text enaio shows for it in its own password dialogs.

The parameters are described in the enaio® administrator documentation under the server properties.

7. Notes

  • When Login\PwdComplexity is empty - the shipped default - the server has no rule to apply and every non-empty password returns True.

  • Never pass the password to krn.VerifyPassword in plaintext yourself: the server always decodes the value, so plaintext turns into garbage and yields a wrong result without any error. This is why the method always does the encoding itself.

  • enaio allows at most 100 characters per password; the client-side encoding caps it further at 128 bytes (AES scheme) or 62 ASCII characters (legacy PwdDecryption=1 scheme).

  • The job takes no user parameter. It always runs in the context of the current session, but only evaluates the server-wide rule - the result is the same for every user.

8. See also