ENG-990: Disallow password which is the same as user's login (#1225)

kingds · web-flow · commit f62f70ba11b9 · 2026-02-24T20:07:41.000-07:00
Added a field `PasswordValidationRules.disallowUserLoginId`, configurable per tenant. If enabled, passwords will be rejected if they contain the user's email, username, or phone number.
diff --git a/openapi.yaml b/openapi.yaml
@@ -5527,6 +5527,8 @@ components:
       properties:
         breachDetection:
           "$ref": "#/components/schemas/PasswordBreachDetection"
+        disallowUserLoginId:
+          type: boolean
         maxLength:
           type: integer
         minLength:
