Password Change Service Beans

Author	Daniel Fisher
Date	2005/04/19

Requirements

No standard way of changing a user id's password exists, instead numerous tools, which operate in different manners, are currently used.
No standard password strength checks are made in any of the plethora of password change tools currently used (with respect to UUPID passwords).

Ability to present two randomly chosen questions from a user id's forgotten password reset question/answer challenge pairs
Ability to reset a user id's forgotten password given the user's UUPID and two correctly answered forgotten password reset questions
Ability to set and update password reset question/answer pairs
A history of the user id's last 4 passwords must be kept
Ability to define a dictionary to check passwords against
Ability to change a user id's password given their UUPID, old password, and new password
Ability to push the password to multiple systems, such the ED-Registry and Active Directory, upon change
Ability to add new systems to receive the password change with relative ease
Ensure new passwords meet the strength requirements currently in place for UUPID passwords.
Ability to check a password's strength without actually changing the password
Ability to change the password with a required strength check
Ability to change the password without checking the strength
Log of the following transactions:
- Who tried to change their password
- Whether the change was successful
- The date and time the event occurred (to within the millisecond)

Must be implemented as a clustered stateless session bean.
All methods must accept UUPIDs as input, not UIDs.
Methods must be exposed as web services.
Must have a low latency, less then 1 second to change a password and return a result, under heavier then expected load
All communication between the password change service session beans and external entities, either clients or services receiving password synchronization updates, must be secure.