Skip to content

Validate password format

IsValidPassword is a stateless format check applied to a candidate password before it is accepted for storage (for example, before Create or update an external user or Change Active Directory password persist it).

Field Value
Operation ID OP-SU-12
Trigger Caller calls clsSystemUser.IsValidPassword(inPwd, [inMinLength], [inMaxLength])
Inputs inPwd candidate password; optional inMinLength (default 5); optional inMaxLength (default 20)
Outputs Boolean result
Primary components clsSystemUser.IsValidPassword(...)
Entry point Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb

Steps

  1. Start valid. isValid is initialized to True.
  2. Check the maximum length. If Len(inPwd) > inMaxLength, isValid is set to False (BR-006).
  3. Check the minimum length. Otherwise, if Len(inPwd) < inMinLength, isValid is set to False (BR-006).
  4. Check for disallowed characters. Independent of the length checks, inPwd Like BADCHARS is evaluated against the pattern "*[^<>.:;/\,~@#$%&()+='{}|_-\? ]"; a match setsisValid = False` (BR-007).
  5. Return the result. The final isValid value is returned.

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([Caller calls IsValidPassword]) --> Init[isValid = True]
    Init --> MaxLen{Len exceeds inMaxLength?}
    MaxLen -->|Yes| Invalid[isValid = False]
    MaxLen -->|No| MinLen{Len below inMinLength?}
    MinLen -->|Yes| Invalid
    MinLen -->|No| CharCheck
    Invalid --> CharCheck{Matches BADCHARS pattern?}
    CharCheck -->|Yes| InvalidChars[isValid = False]
    CharCheck -->|No| Return([Return isValid])
    InvalidChars --> Return

Failure and edge-case behavior

  • The length and character checks are independent — a password can fail one, the other, or both, and the final result is False if any check fails, but the method gives no indication of which check failed.
  • The BADCHARS pattern is a Like expression, not a documented allow-list; interpreting exactly which characters it excludes requires reading the raw pattern in source.*
  • Passing a min/max length outside the caller's actual intent (e.g., inMinLength greater than inMaxLength) is not guarded against and would make all candidates fail the length check.*

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

Sources

  • Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb