Provide hooks for password policy

[Paul McMillan]

While it is possible to change the validation for new passwords by subclassing the form, I think that Django should provide a more friendly interface for this. We should have a pluggable password authentication framework which enforces no rules by default, but comes with several reasonable example policies which may be enabled.

Problems to be solved include:

• Informing the user of the various password requirements
• Allowing policies to chain together smoothly
• Provide flexibility for complex requirements (some may include their own models)
• Backwards compatibility
• Javascript validation assistance (someday, maybe?)
• HTML5 support (i.e. the pattern attribute)
• Prevent using email, username or other user attributes as (part of) passwords
• Prevent reuse of old passwords

[Collin Anderson]

mailing list discussion: ​https://groups.google.com/d/topic/django-developers/kec0UF_xc3k/discussion

[Shai Berger]

I replaced two requirements that seem to be applicable to login pages (rate-limiting & lockout, captcha) with ones more applicable to password setting (use of user attributes, old password reuse).

[Sasha Romijn]

I've submitted a PR with a demo of a fresh approach on ​https://github.com/django/django/pull/4276
The PR is not meant to be mergable.

New mailing list discussion on: ​https://groups.google.com/forum/#!topic/django-developers/9GBhgGXmEKs

[Sasha Romijn]

I've updated the PR for the many (good) comments and I believe it's now ready for merge, after a rebase. Could someone do a final review?

I've spoken to Aymeric about integrating this with the User model instead of adding a setting, but we concluded that this design is not a substantial improvement and does introduce a more complex coupling that is currently not needed. Therefore, we stuck to the basic idea of using a setting for configuration.

[Erik Romijn <eromijn@…>]

In 1daae25:

Fixed #16860 -- Added password validation to django.contrib.auth.

[Tim Graham <timograham@…>]

In 55b3bd8:

Refs #16860 -- Minor edits and fixes to password validation.

[Tim Graham <timograham@…>]

In 09f2cdb:

Refs #16860 -- Fixed a resource and deprecation warning in password validation.

[Tim Graham <timograham@…>]

In f5e9d67:

Refs #16860 -- Moved password_changed() logic to AbstractBaseUser.

Thanks Carl Meyer for review.

[Tim Graham <timograham@…>]

In 774c16d1:

Fixed #25052; refs #16860 -- Added password validation to UserCreationForm.

[Tim Graham <timograham@…>]

In 53ccffd:

Refs #16860 -- Fixed password help text when there aren't any validators.

This avoids creating an empty list which is invalid HTML 4.

[Tim Graham <timograham@…>]

In db88e40:

[1.9.x] Refs #16860 -- Fixed password help text when there aren't any validators.

This avoids creating an empty list which is invalid HTML 4.

Backport of 53ccffdb8c8e47a4d4304df453d8c79a9be295ab from master