feat: read the lockout threshold and window in the password policy

The password change must stay below the domain's lockout threshold. The policy now carries lockout_threshold and lockout_window, from the domain or from the fine-grained policy that applies. AD-2's read allow-list names the new attributes.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC
This commit is contained in:
2026-10-18 09:55:10 +02:00
co-authored by Claude Sonnet 5.5
parent ead56709bc
commit b87ffae94c
7 changed files with 24 additions and 1 deletions
+1
View File
@@ -86,6 +86,7 @@ def test_password_policy_is_returned(directory):
policy = directory.password_policy("alice")
assert policy.min_length == 8
assert policy.min_age == timedelta(0)
assert policy.lockout_threshold == 5
def test_password_change_needs_the_current_password(directory):