NPM Website - allow users to set password criteria / new authentication methods

[ccystephenclinton]

Hello 👋

Many enterprises that use npm will likely have security controls around authorisation/passwords and currently, the NPM website doesn't support anything beyond simple username/password autentication.

Some suggestions:

• Allow org owners to enforce a minimum password length for accounts in an organisation
• Allow org owners to enforce a password complexity standard (e.g. special chars, numbers etc)
• Allow org owners to set password rotation standards - e.g must be rotated every X weeks
• Allow org owners to enforce lockout policies
• Allow federation with Azure AD SSO? Not sure if this is possible but would be a major benefit for admins managing organisations.