I placed treatment of the password, hashing and so forth in beforeSave().

Used a function placed in app_model to see if the passwords match:
http://bakery.cakephp.org/articles/view/using-equalto-validation-to-compare-two-form-fields

Then placed the regex for testing quality of the password in the validate rules:
‘password’ => array(‘isRequired’ => array(‘rule’ => array(‘custom’, ‘/(?=^.{7,}$)((?=.*\d)|(?=.*\W+))(?![.\n])(?=.*[A-Z])(?=.*[a-z]).*$/’),
‘required’ => true,
‘allowEmpty’ => false,
‘on’ => ‘create’,
‘message’ => ‘Password should be at least 7 characters, must have at least 1 upper case, lower case and numeric or special character.’),
‘identicalFieldValues’ => array(‘rule’ => array(‘identicalFieldValues’, ‘password_confirm’ ),
‘message’ => ‘Passwords do not match.’,
‘on’ => ‘create’))

Also used multiple validation sets which were handy:
http://snook.ca/archives/cakephp/multiple_validation_sets_cakephp/

Using 1.2, no auth component.

A few poster comments were lost this last week due to a DB restore.

Please do not take offense, and re-post at will.

This works on 1.1 or 1.2
I’m not sure I understand your meaning, the $validate variable in the models? How would you match 2 passwords, check for a high-security pattern, and then finally hash? If you have a sweeter way, please share

validates($options = array())