Add regex to password complexity in Sitecore 8 - passwords

Question

The requirement is to require users to have complex passwords requiring minimum length of 8 characters. 1+ non alpha numeric character. 1+ lowercase alpha character. 1+ uppercase alpha character. 1+ number.
I can accomplish this by adding the following to the web.config
<add name="sql" type="System.Web.Security.SqlMembershipProvider" connectionStringName="core" applicationName="sitecore" minRequiredPasswordLength="8" minRequiredNonalphanumericCharacters="1" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" maxInvalidPasswordAttempts="5" passwordStrengthRegularExpression="(?=.{8,})(?=.*[\d])(?=.*[a-z])(?=.*[A-Z]).*" />
passwordStrengthRegularExpression validation seems to not be handled by Sitecore as I get the following unhandled exception when an invalid password is entered:
376 15:59:41 ERROR Application error.
Exception: System.Web.HttpUnhandledException
Message: Exception of type 'System.Web.HttpUnhandledException' was thrown.
Source: System.Web
at System.Web.UI.Page.HandleError(Exception e)
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
at System.Web.UI.Page.ProcessRequest()
at System.Web.UI.Page.ProcessRequest(HttpContext context)
at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
Nested Exception
Exception: System.Reflection.TargetInvocationException
Message: Exception has been thrown by the target of an invocation.
Source: mscorlib
at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments)
at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
at Sitecore.Web.UI.XamlSharp.Xaml.XamlControl.ExecuteAjaxMethod(AjaxMethodEventArgs e)
at Sitecore.Web.UI.WebControls.AjaxScriptManager.DispatchMethod(Control control, String parameters)
at Sitecore.Nexus.Pipelines.NexusPipelineApi.Resume(PipelineArgs args, Pipeline pipeline)
at Sitecore.Pipelines.Pipeline.Start(PipelineArgs args, Boolean atomic)
at Sitecore.Web.UI.WebControls.ContinuationManager.RunPipelines()
at Sitecore.Web.UI.WebControls.ContinuationManager.OnPreRender(EventArgs e)
at System.Web.UI.Control.PreRenderRecursiveInternal()
at System.Web.UI.Control.PreRenderRecursiveInternal()
at System.Web.UI.Control.PreRenderRecursiveInternal()
at System.Web.UI.Control.PreRenderRecursiveInternal()
at System.Web.UI.Control.PreRenderRecursiveInternal()
at System.Web.UI.Control.PreRenderRecursiveInternal()
at System.Web.UI.Control.PreRenderRecursiveInternal()
at System.Web.UI.Control.PreRenderRecursiveInternal()
at System.Web.UI.Control.PreRenderRecursiveInternal()
at System.Web.UI.Control.PreRenderRecursiveInternal()
at System.Web.UI.Control.PreRenderRecursiveInternal()
at System.Web.UI.Control.PreRenderRecursiveInternal()
at System.Web.UI.Control.PreRenderRecursiveInternal()
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
Nested Exception
Exception: System.ArgumentException
Message: The parameter 'newPassword' does not match the regular expression specified in config file.
Source: System.Web
at System.Web.Security.SqlMembershipProvider.ChangePassword(String username, String oldPassword, String newPassword)
at Sitecore.Data.DataProviders.NullRetryer.Execute[T](Func`1 action, Action recover)
at Sitecore.Security.SitecoreMembershipProvider.ChangePassword(String username, String oldPassword, String newPassword)
at Sitecore.Security.Accounts.MembershipUserWrapper.ChangePassword(String oldPassword, String newPassword)
at Sitecore.Shell.Applications.Security.SetPassword.SetPasswordPage.OK_Click()
Can this be accomplished by modifying config values or is this something that can easily be accomplished by patching the <loggingin> pipeline?

Answer 1

Looking at the code for the SitecoreMembershipProvider there is a wrapper property for PasswordStrengthRegularExpession and the material methods just hand off processing to the underlying provider, in this case the SqlMembershipProvider. So the error is actually being generated there, as you see from the stack trace.
The exception is actually an expected behaviour for this method according to the MSDN documentation. In your application's login/change password/new user forms you should validate a user's entry against Membership.PasswordStrengthRegularExpression manually to ensure the complexity requirement is met before passing the new value back to Sitecore.
It's hard to tell from your question, but does this cover your case, or are you referring to an error being generated in the Sitecore Change Password dialog (haven't tried that)? If that's the case I would raise a support ticket, as the system really should gracefully cope with that situation. Notwithstanding the documentation eluded to by Nikola (#nsgocev) it seems that at least the author of the Sitecore wrapper did implement at least rudimentary wrappers for this property.