How to Update Tanzu Operations Manager UAA password policy

Products

• VMware Tanzu Platform - Cloud Foundry

Issue/Introduction

Tanzu Operations Manager UAA contains a default password policy with the following parameter settings.

  "password_policy": {
    "password_min_uppercase": 0,
    "password_min_lowercase": 0,
    "password_min_numeric": 0,
    "password_min_special": 0,
    "password_expires_after_months": 0,
    "password_min_length": 0
  }

 

There is no interface on Operations Manager web UI to update the default password policy. This articles explains how to update the parameters in default password policy.

Environment

Tanzu Operations Manager

Resolution

Tanzu Operations Manager provides API /api/v0/uaa/password_policy to view/update the parameters in password policy. 

1) Log in to UAAC as an admin

2) Retrieve the current password policy settings

$ uaac curl -k https://opsmgr.example.net/api/v0/uaa/password_policy
GET https://opsmgr.example.net/api/v0/uaa/password_policy

200 OK
......
RESPONSE BODY:
{
  "password_policy": {
    "password_min_uppercase": 0,
    "password_min_lowercase": 0,
    "password_min_numeric": 0,
    "password_min_special": 0,
    "password_expires_after_months": 0,
    "password_min_length": 0
  }
}

 

3) Update the parameters in password policy by calling /api/v0/uaa/password_policy with PUT method by setting desired parameters in payload

$ uaac curl -k https://opsmgr.example.net/api/v0/uaa/password_policy -H 'Content-Type: application/json' -X PUT -d '{"password_policy":{"password_min_uppercase":"1","password_min_lowercase":"1","password_min_length":"8","password_min_numeric":"1","password_min_special":"1","password_expires_after_months":"24"}}'
PUT https://opsmgr.example.net/api/v0/uaa/password_policy
......

200 OK
......
RESPONSE BODY:
{
  "password_policy": {
    "password_min_uppercase": 1,
    "password_min_lowercase": 1,
    "password_min_numeric": 1,
    "password_min_special": 1,
    "password_expires_after_months": 24,
    "password_min_length": 8
  }
}

  

4) Confirm the password policy is updated successfully

$ uaac curl -k https://opsmgr.example.net/api/v0/uaa/password_policy
GET https://opsmgr.example.net/api/v0/uaa/password_policy

200 OK
......

RESPONSE BODY:
{
  "password_policy": {
    "password_min_uppercase": 1,
    "password_min_lowercase": 1,
    "password_min_numeric": 1,
    "password_min_special": 1,
    "password_expires_after_months": 24,
    "password_min_length": 8
  }
}

 

NOTE: Do NOT attempt to update the password policy via UAA /dentity_provider API call since this will cause data inconsistency between UAA and Operations Manager databases.