Block user create with certain characters/strings

[peternied]

During the user creation flow a user can be created that has the colon character : this user cannot use basic authentication to login - a bad experience. We should safeguard the creation of user to exclude scenarios that are fundamentally invalid.

I would recommend that we try to keep this list as slim as possible to prevent customers from being unable to upgrade from a previous version to a newer version of OpenSearch.

JSON Valid Characters

As OpenSearch communicates via JSON documents, following the JSON definition seems like an easy route to follow as it has minimal restrictions in place. Here are some interesting strings that are allowed.

• {"🐶🔫": "not nice, but still valid json"}
• { "*~@#$%^&*()_+=><?/": "is a valid json" }

From https://stackoverflow.com/a/8676132/533057

@shanilpa Could you look into this and provide recommendations if you'd like to see additional restrictions?

[cwperks]

[Triage] @shanilpa Would you investigate and report back?

[shanilpa]

Did some digging and this is what I am recommending after synthesizing from a bunch of Google Searches 😅 . If anyone thinks we should expand or reduce this list feel free to leave a comment. As a non developer I'm not sure if some characters might impact code. I've added comments @peternied or someone else please review and we can arrive at a finalized list and some rules.

Acceptable characters for a username can include:

• Lowercase characters: a-z
• Uppercase characters: A-Z
• Numbers: 0-9

Characters that might conflict with code if first but not sure:

• Exclamation: !
• Open / Close Parenthesis: ()
• Open/Close Square bracket: []
• Dash: -
• Underscore: _
• Period: .
• Question mark: ?
• Number Sign: #
• Dollar Sign: $
• Plus sign: +
• Equals sign: =

Additional characters to support accents in names not sure if these are all ASCII?:

• Grave accent: ` (eg. è)
• Tilde: ~ (eg. ñ)
• Acute accent: á
• Circumflex accent: â
• Diaeresis, or trema, or umlaut: ü
• Cedilla: ç
• Ring, or bolle: å
• slash, or solidus, or virgule: ø

Rules

• Can't use a space in a user name: eg. user name
• Can't use the same special character more than once consecutively. eg. user...name
• Can't use Non-ASCII characters

[davidlago]

[Triaging] Capturing what we discussed in our triaging meeting: we need to be careful, as restricting usernames is a breaking change we'll need to navigate (what happens with users created prior to this rule that now break it?)