4 files changed, 20 insertions, 12 deletions
diff --git a/certs/app/models/client_certificate.rb b/certs/app/models/client_certificate.rb
index 1bc34c6..13e0318 100644
--- a/certs/app/models/client_certificate.rb
+++ b/certs/app/models/client_certificate.rb
@@ -66,8 +66,7 @@ class ClientCertificate
   end
 
   def common_name(for_free_cert = false)
-    random_common_name +
-      (for_free_cert ? APP_CONFIG[:free_cert_postfix] : '')
+    (for_free_cert ? APP_CONFIG[:free_cert_prefix] : '') + random_common_name
   end
 
   #
diff --git a/certs/test/unit/client_certificate_test.rb b/certs/test/unit/client_certificate_test.rb
index bcc61cc..abb5560 100644
--- a/certs/test/unit/client_certificate_test.rb
+++ b/certs/test/unit/client_certificate_test.rb
@@ -9,16 +9,16 @@ class ClientCertificateTest < ActiveSupport::TestCase
     assert sample.to_s
   end
 
-  test "free cert has configured postfix" do
+  test "free cert has configured prefix" do
     sample = ClientCertificate.new(free: true)
-    postfix = APP_CONFIG[:free_cert_postfix]
-    assert sample.cert.subject.common_name.include?(postfix)
+    prefix = APP_CONFIG[:free_cert_prefix]
+    assert sample.cert.subject.common_name.starts_with?(prefix)
   end
 
-  test "real cert has no free cert postfix" do
+  test "real cert has no free cert prefix" do
     sample = ClientCertificate.new
-    postfix = APP_CONFIG[:free_cert_postfix]
-    assert !sample.cert.subject.common_name.include?(postfix)
+    prefix = APP_CONFIG[:free_cert_prefix]
+    assert !sample.cert.subject.common_name.starts_with?(prefix)
   end
 
   test "cert issuer matches ca subject" do
diff --git a/config/defaults.yml b/config/defaults.yml
index 54e4178..d0fb52f 100644
--- a/config/defaults.yml
+++ b/config/defaults.yml
@@ -8,7 +8,7 @@ cert_options: &cert_options
   client_cert_bit_size: 2024
   client_cert_hash: "SHA256"
   free_certs_enabled: true
-  free_cert_postfix: "*Free Cert*"
+  free_cert_prefix: "FREE"
 
 development:
   <<: *dev_ca
@@ -21,7 +21,6 @@ test:
   <<: *cert_options
   admins: [admin, admin2]
   domain: test.me
-  
 
 production:
   <<: *cert_options
diff --git a/users/app/models/user.rb b/users/app/models/user.rb
index e41c2dc..c9b367f 100644
--- a/users/app/models/user.rb
+++ b/users/app/models/user.rb
@@ -18,9 +18,19 @@ class User < CouchRest::Model::Base
     :uniqueness => true,
     :if => :serverside?
 
+  # Have multiple regular expression validations so we can get specific error messages:
   validates :login,
-    :format => { :with => /\A[A-Za-z\d_\.]+\z/,
-      :message => "Only letters, digits, . and _ allowed" }
+    :format => { :with => /\A.{2,}\z/,
+      :message => "Login must have at least two characters"}
+  validates :login,
+    :format => { :with => /\A[a-z\d_\.-]+\z/,
+      :message => "Only lowercase letters, digits, . - and _ allowed."}
+  validates :login,
+    :format => { :with => /\A[a-z].*\z/,
+      :message => "Login must begin with a lowercase letter"}
+  validates :login,
+    :format => { :with => /\A.*[a-z\d]\z/,
+      :message => "Login must end with a letter or digit"}
 
   validate :login_is_unique_alias