A password policy defines the password characteristics ASP.NET Core Identity accepts when creating users. Validation failures return through IdentityResult and can appear in the model validation summary. section 38.3.3
Configure the policy through IdentityOptions.Password, which exposes PasswordOptions properties:
- RequiredLength sets the minimum password length. section 38.3.3
- RequireNonAlphanumeric, RequireLowercase, RequireUppercase, and RequireDigit require specific character categories when enabled. section 38.3.3
Relaxing validation for a demonstration
Configure a six-character minimum, then disable nonalphanumeric, case, and digit requirements. After restarting the application, the password "secret" is accepted when creating a user; apply such a weak policy cautiously in real projects. section 38.3.3
Listing 38.14 Changing validation in the Program.cs file in the Advanced project
...
builder.Services.Configure<IdentityOptions>(opts => {
opts.Password.RequiredLength = 6;
opts.Password.RequireNonAlphanumeric = false;
opts.Password.RequireLowercase = false;
opts.Password.RequireUppercase = false;
opts.Password.RequireDigit = false;
opts.User.RequireUniqueEmail = true;
opts.User.AllowedUserNameCharacters = "abcdefghijklmnopqrstuvwxyz";
});
...
Inspect the complete Program.cs configuration, including password settings alongside username and email validation. section 38.3.3
