title: Do any openid providers allow for configurable password or other security requirements?
body: <p>I'm working on an app where our customers have some conflicting requirements</p>
  
  <p>1) Pretty complex password requirements (I'm trying to sell them on long pass phrases with no other requirements, but its government bureaucracy, so not holding out hope) <a href="https://xkcd.com/936/" rel="nofollow">https://xkcd.com/936/</a></p>
  
  <p>2) reluctance to have to manage user signing up, forgetting password, recovery, unlocks, etc</p>
  
  <p>3) Not wanting us to spend a lot of time/$ writing automation for that.</p>
  
  <p>So, is it possible to delegate authentication to say google, or facebook, or whoever, but have them enforce policies such as password length/complexity (perhaps from a menu of password complexities that they offer), or must have 2 factor enabled, or maximum retries, etc?</p>