Setup: php admin/cli/cfg.php --name=passwordpolicy --set=1 php admin/cli/cfg.php --name=passwordpolicycheckonlogin --set=1 Test normal accounts which can have passwords changed 1) Ensure the admin account (or whichever test account is required) is using the 'manual' login type. 2) Set the admin account password to a weak password 'a'. php admin/cli/reset_password.php --username=admin --password=a --ignore-password-policy 3) Logout of Moodle, and attempt to login 4) Verify that you are sent to the \login\change_password.php page 5) Verify that there is a red notification box with the text 'Your current password no longer matches the set password policy.' 6) Verify that the checks that were failed are displayed to the user. 7) Verify that there is a red notification box with the text 'You must change your password to proceed.'   Test auth types with an external change the password page   1) Logout of Moodle, and modify auth manual to an external password change url auth/manual/auth.php Modify the change_password_url to take us to google function  change_password_url() { return 'https://www.google.com' ; } function is_internal() { return false ; } 3) Attempt to login to Moodle again 4) Verify you are redirected to Google 5) Press Back in the browser 6) Click Logout on the logout confirmation screen 7) Click Continue on the next confirmation screen  Test auth types which cannot change the password 1) Modify auth manual to disable the ability to change password  auth/manual/auth.php function can_change_password() { return false ; } function is_internal() { return true ; } 2) Attempt to login to Moodle again 3) Verify you are redirected to the password reset page /login/forgot_password.php 3) Verify there is an error notification with the text 'You must reset your password to login. ' 4) Verify that the checks that were failed are displayed to the user.   Test auth types which cannot reset the password 2) Disable the password policy to a different simple password, to reset the must_change_password user preference php admin/cli/cfg.php --name=passwordpolicy --set=0 auth/manual/auth.php function can_change_password() { return true; } function change_password_url() { return null ; } 2) Log into Moodle, and manually change the password to another simple password 'b' 3) Log out of Moodle. 4) Put the password policy back in place php admin/cli/cfg.php --name=passwordpolicy --set=1 5) Modify auth manual to disable password resets and password changes. auth/manual/auth.php function can_reset_password() { return false; } function can_change_password() { return false ; } 6) Attempt to login to Moodle again 7) Verify that you are able to login to the site 8) Verify that a warning notification is shown with the text 'Your password no longer passes the set password policy, however the authentication type does not allow for changing or resetting of passwords. Please contact your Moodle administrator for assistance. ' 9) Verify that the checks that were failed are displayed to the user. 10) Visit the logs for the system at http://moodlecore.lan/report/log/index.php 11) Verify that there are 3 events for 'User password failed password policy. 12) Verify that all the information for the event matches the correct username. 13_ Verify that the Event Name link correctly links to the user profile.