krn.VerifyPassword

This job matches a given password against the server’s password syntax rule — the regular expression in the registry entry Login\PwdComplexity (in the enaio® enterprise-manager "Regulärer Ausdruck für die Passwortsyntax") — and returns whether the password satisfies that rule. The job is therefore the pre-check for exactly the rule the server enforces when a password is assigned or changed.

The job does not check whether the given password matches a user’s stored password.

Matches is not an authentication result. With no rule configured — Login\PwdComplexity is empty in the shipped default — every non-empty password returns true. Code that reads Matches as "password correct" therefore lets every user in with any password. Use krn.CheckUserAccount for credential checks.

This job is not listed in the official enaio® kernel engine overview, but it is present in the server’s job catalogue (krn.EnumJobs). The behaviour described here was verified against a enaio® 12.0 server.

1. Input Parameters

Name Type Required Description

Flags

INT

Yes

Reserved; always pass 0. Other values are accepted without an error.

Password

STRING

Yes

Password to check, as an encoded value — same format as krn.SessionLogin/UserPwd. Encoding scheme according to the registry entry Security\PwdDecryption (> 1 = AES, ⇐ 1 = legacy scheme), at most 62 ASCII characters.

A wrong encoding fails silently. The server always decodes the value of Password; plaintext is decoded into garbage and evaluated against the rule — the result is wrong without any error being reported. Example: with Login\PwdComplexity = ^.{12,}$, the plaintext abc returns true.

2. Output Parameters

Name Type Dependency Description

Matches

BOOL

—

true if the decoded password satisfies the regular expression from Login\PwdComplexity, otherwise false. If Login\PwdComplexity is empty (shipped default), the result is true for every non-empty password.

Observed behaviour:

Configuration Input Matches

Login\PwdComplexity empty (shipped default)

any non-empty password

true

Login\PwdComplexity = ^.{12,}$

abcdefghijkl (12 characters)

true

Login\PwdComplexity = ^.{12,}$

abc

false

Login\PwdComplexity = ^.{12,}$

the correct password of the logged-in user (7 characters)

false

The last row rules out any relation to the stored password.

3. No User Context, No System Role

  • The job takes no user parameter and evaluates only the server-wide rule — the result is identical for every user.

  • A context switch via $$$SwitchContextUserName$$$ (see Switching the User Context) does not change the outcome.

  • Unlike krn.CheckUserAccount, the job requires no system role — a user with zero system roles can call it.

4. Return Value

(INT): 0 = job successful (also when Matches=false), otherwise error code.

Code Server message Cause

-1043332470

A required parameter was not specified: Password.

Password omitted

-1043332107

Parameter <Password> was provided, but the value is invalid: <>.

Password empty

-1043332467

user GUID

Unknown user in a context switch via $$$SwitchContextUser*$$$

5. Related Settings

enaio® enterprise-manager Registry entry Default

Regulärer Ausdruck für die Passwortsyntax

Login\PwdComplexity

empty

Beschreibungstext zur Passwortsyntax

Login\PwdComplexityDescription

empty

Login\PwdComplexityDescription holds the text enaio®'s own password dialogs show for the rule — it is the natural error message when Matches is false. enaio® allows at most 100 characters per password.

Both entries can be read via krn.REGetRegValue.

6. See Also

  • krn.CheckUserAccount — credential check (user name + password)

  • krn.SessionChangePassword — change the password (with confirmation of the old password)

  • krn.SessionLogin — initial login with password verification

  • krn.SessionCheckPwd — by its name the candidate for verifying the session user’s password, i.e. for the function initially attributed to this job. Not documented and not examined (see Undocumented Endpoints).