infra/tickets

Fork 1

[Bug] `accounts.centOS.org` does not accept passwords of the length that `accounts.fedoraProject.org` does. #13507

New issue

Open

opened 2026-08-14 14:56:46 +00:00 by rokejulianlockhart · 5 comments

rokejulianlockhart commented

2026-08-14 14:56:46 +00:00

Description of request

My FAS password is comprised of 128 characters. It is accepted, when authenticating at accounts.fedoraproject.org#login. This should be usable for CentOS, too:

You can also use your Fedora account to login here.

However, when I attempt to authenticate at accounts.centos.org/#login, I observe:

Unauthorized: bad credentials.

After posting discussion.fedoraproject.org/t/199248, I discovered that accounts.centos.org/forgot-password/change informs me that:

Field must be between 8 and 122 characters long.

Reducing the length of the password to 122 characters permitted me to authenticate.

### Description of request My FAS password is comprised of 128 characters. It is accepted, when authenticating at [`accounts.fedoraproject.org#login`](https://accounts.fedoraproject.org/#login). This should be usable for CentOS, too: > You can also use your Fedora account to login here. However, when I attempt to authenticate at [`accounts.centos.org/#login`](https://accounts.centos.org/#login), I observe: > Unauthorized: bad credentials. After posting [`discussion.fedoraproject.org/t/199248`](https://discussion.fedoraproject.org/t/why-does-centos-login-not-accept-the-fas-credentials-that-it-purports-to/199248), I discovered that [`accounts.centos.org/forgot-password/change`](https://accounts.centos.org/forgot-password/change) informs me that: > Field must be between 8 and 122 characters long. Reducing the length of the password to 122 characters permitted me to authenticate.

rokejulianlockhart changed title from ~~[Bug] CentOS Accounts does not accept passwords of the length that FAS does.~~ to [Bug] accounts.centOS.org does not accept passwords of the length that accounts.fedoraProject.org does.

2026-08-14 15:01:25 +00:00

kevin commented

2026-08-14 17:42:06 +00:00

Owner

I'm not sure why it would work on accounts.fedoraproject.org. The config has:

Max password length + 6-digits OTP is 128: https://pagure.io/freeipa/issue/9600

PASSWORD_POLICY = {"min": 8, "max": 122}

It's possible you set it to 128 before that limit was in place.

The "Unauthorized: bad credentials." sounds a lot like sporadic auth issues we have been trying to track down in #13482
If you just try again does it work now?

I'm not sure why it would work on accounts.fedoraproject.org. The config has: # Max password length + 6-digits OTP is 128: https://pagure.io/freeipa/issue/9600 PASSWORD_POLICY = {"min": 8, "max": 122} It's possible you set it to 128 before that limit was in place. The "Unauthorized: bad credentials." sounds a lot like sporadic auth issues we have been trying to track down in https://forge.fedoraproject.org/infra/tickets/issues/13482 If you just try again does it work now?

😕 1

rokejulianlockhart commented

2026-08-14 18:10:06 +00:00

Author

It obviously consistently works now, because my password is < 128 characters. This is definitely due to password length. Consequently, do you want me to try registering a 128-character password at FAS again, to ensure that the limitation is actually enforced?

Your estimation that I registered it before that was instituted might be correct, although because you didn't cite the document where you acquired that information from, I'm unable to compare its Git record to my Bitwarden vault entrant revision records.

@kevin, the error message occurred consistently; I tried eight times at the CentOS authentication page, and ensured that, during that timespan, I was able to authenticate at the FAS login page. I expect that the sole correlation between this problem, and that one, is the uselessly non-descript error message. It obviously consistently works now, because my password is < 128 characters. This is definitely due to password length. Consequently, do you want me to try registering a 128-character password at FAS again, to ensure that the limitation is actually enforced? Your estimation that I registered it before that was instituted might be correct, although because you didn't cite the document where you acquired that information from, I'm unable to compare its Git record to my Bitwarden vault entrant revision records.

kevin commented

2026-08-18 19:03:12 +00:00

Owner

You could try and switch to a 128 character password now, but it should not let you do so.

I suppose it might be good to confirm that?

You could try and switch to a 128 character password now, but it should not let you do so. I suppose it might be good to confirm that?

👍 1

rokejulianlockhart commented

2026-08-18 19:08:59 +00:00

Author

@kevin, it's prevented:

Consequently, this bug solely affects accounts whose passwords were grandfathered in from > 122 characters. Ideally, we should either invalidate all of those passwords, thereby enforcing a password reset, or we should modify CentOS's authentication page to accept them, as FAS's does.

@kevin, it's prevented: ![image](/attachments/73a8d380-34f5-4da9-b1d9-6846557837a4) Consequently, this bug solely affects accounts whose passwords were grandfathered in from > 122 characters. Ideally, we should either invalidate all of those passwords, thereby enforcing a password reset, or we should modify CentOS's authentication page to accept them, as FAS's does.

image.png

43 KiB

kevin commented

2026-08-18 22:36:13 +00:00

Owner

Yeah, I am going to suspect there's very few people with 128+ char passwords.
Unfortunately, I dont think we have any way to know thought.

I don't understand why the centos version of the app wouldn't accept it... it's the same app, just a different theme.

@abompard any ideas?

Yeah, I am going to suspect there's very few people with 128+ char passwords. Unfortunately, I dont think we have any way to know thought. I don't understand why the centos version of the app wouldn't accept it... it's the same app, just a different theme. @abompard any ideas?