Excluding specific users

django-password-policies-iplweb allows you to exclude specific users from password policy enforcement by username. This is useful for service accounts, bot users, or other automated accounts that should not be subject to password policies.

Two separate settings control different aspects of the password policy:

Excluding users from password expiry

To prevent specific users from being forced to change their password when it expires, add their usernames to PASSWORD_CHANGE_MIDDLEWARE_EXCLUDED_USERNAMES in your Django settings:

PASSWORD_CHANGE_MIDDLEWARE_EXCLUDED_USERNAMES = [
    "servicebot",
    "api_worker",
]

Users in this list will never be redirected to the password change page by the PasswordChangeMiddleware, even if their password has expired or a PasswordChangeRequired entry exists.

Note

This setting only affects the middleware. If an excluded user voluntarily visits the password change page, password complexity rules will still apply unless the user is also listed in PASSWORD_COMPLEXITY_EXCLUDED_USERNAMES.

Excluding users from password complexity validation

To allow specific users to set passwords without complexity validation (character composition, entropy, dictionary checks, password history), add their usernames to PASSWORD_COMPLEXITY_EXCLUDED_USERNAMES:

PASSWORD_COMPLEXITY_EXCLUDED_USERNAMES = [
    "servicebot",
    "api_worker",
]

Users in this list will not have their passwords validated against:

• Character composition rules (minimum letters, numbers, symbols)

• Entropy requirements

• Common sequence detection

• Dictionary word matching

• Password history (reuse prevention)

Warning

Excluding users from complexity validation reduces the security of those accounts. Only add users to this list when there is a clear operational need, such as service accounts managed by automated systems.

Combining both settings

The two settings are independent. You can exclude a user from expiry checks only, complexity checks only, or both:

# This user is excluded from both expiry and complexity checks
PASSWORD_CHANGE_MIDDLEWARE_EXCLUDED_USERNAMES = ["servicebot"]
PASSWORD_COMPLEXITY_EXCLUDED_USERNAMES = ["servicebot"]

# This user is only excluded from expiry (still gets complexity checks)
PASSWORD_CHANGE_MIDDLEWARE_EXCLUDED_USERNAMES = ["api_worker"]

Both settings match against the username field (as returned by User.get_username()). Both default to an empty list, preserving backward compatibility.