I'd like to know what are considered modern best practices for what to allow users to set their password to.
My go-to for this is NIST Special Publication 800-63B: Digital Identity Guidelines
Authentication and Lifecycle Management, section 5.1.1 Memorized Secrets.
Here are some relevant excerpts from that document:
184.108.40.206 Memorized Secret Authenticators
Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber.
Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric. If the CSP or verifier disallows a chosen memorized secret based on its appearance on a blacklist of compromised values, the subscriber SHALL be required to choose a different memorized secret. No other complexity requirements for memorized secrets SHOULD be imposed. A rationale for this is presented in Appendix A Strength of Memorized Secrets.
220.127.116.11 Memorized Secret Verifiers
When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised. For example, the list MAY include, but is not limited to:
- Passwords obtained from previous breach corpuses.
- Dictionary words.
- Repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’).
- Context-specific words, such as the name of the service, the username, and derivatives
Tools like zxcvbn (github.com/dropbox/zxcvbn. demo at lowe.github.io/tryzxcvbn, thanks @fread2281) include dictionary-based blacklists and checks for common sequences. For non-government applications, most people consider this sufficient.
To meet the first bullet, you'll need a comprehensive blacklists of compromised passwords -- the best one is the ~12 gb database maintained at haveibeenpwned.com.
To meet the 4th bullet, you'll need to maintain your own blacklist of terms that have special meaning within your app (name of the service, username, roles within your app like "admin" or "instructor", etc)
As you point out, "complexity rules" like One Upper, One Lower, One Symbol are going out of style and should not be used. As the mandotory XKCD points out, "Through 20 years of effort, we've successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess."