We're trying to build a solution where we have a requirement to check password compliance of a user with respect to all the systems that he has to.
For example, if system 1 mandates that password should have 4 alphabets and system 2 has a requirement of 5 alphabets, if the user happens to have access to both systems 1 & 2 , we need to make sure that his current password has 5 alphabets. We have similar password composition requirements like number of special characters, number of digits, min length etc.
Systems are at liberty to change password composition at any time so when the user logs in to any of the systems that he has access to, we need to calculate effective password policy (basically a union of all individual system policies) and prompt the user to change his password if it's not compliant.
We want to do this without having to store/ remember the user's password in plain text anywhere and in a secure fashion.
Our current option is,
Get password composition (just the no of digits, alphabets, special characters, length) during login and pass that information to a service that can tell us whether it's compliant or not.
Is there any better way to do this ? Appreciate any help on this.
Note: If you think that this should be asked in a different site in stack exchange, please let me know.