robe-auth/src/main/java/io/robe/auth/AbstractAuthResource.java
public void verifyPasswordStrength(String oldPassword, String newPassword, T user) throws AuthenticationException {
        List<Rule> rules = getPasswordRules();
        PasswordValidator validator = new PasswordValidator(rules);
        PasswordData passwordData = new PasswordData(new Password(newPassword));
        RuleResult result = validator.validate(passwordData);
        if (!result.isValid()) {
            StringBuilder messages = new StringBuilder();
            for (String msg : validator.getMessages(result)) {
                messages.append(msg).append("\n");
            }
            throw new AuthenticationException(messages.toString());
        }


    }
public void verifyPasswordStrength(String oldPassword, String newPassword, T user) throws AuthenticationException {
        List<Rule> rules = getPasswordRules();
        PasswordValidator validator = new PasswordValidator(rules);
        PasswordData passwordData = new PasswordData(new Password(newPassword));
        RuleResult result = validator.validate(passwordData);
        if (!result.isValid()) {
            StringBuilder messages = new StringBuilder();
            for (String msg : validator.getMessages(result)) {
                messages.append(msg).append("\n");
            }
            throw new AuthenticationException(messages.toString());
        }


    }
Ensures that the password meets site-specific complexity requirements, like length or number
of character sets. This method takes the old password so that the algorithm can analyze the
new password to see if it is too similar to the old password. Note that this has to be
invoked when the user has entered the old password, as the list of old
credentials stored by ESAPI is all hashed.
Additionally, the user object is taken in order to verify the password and account name differ.

@param oldPassword the old password
@param newPassword the new password
@param user        the user
@throws io.dropwizard.auth.AuthenticationException if newPassword is too similar to oldPassword or if newPassword does not meet complexity requirements