8.3 Configuring the Forgotten Password Settings

Self Service Password Reset allows users to recover a forgotten password without contacting the help desk. The Forgotten Password is a configurable feature. After enabling this feature, users see the Forgotten Password option on the user login web page.

You can also set up policies for Forgotten Password. This feature uses challenge-response authentication to let users recover their passwords. This feature enables prompting for challenge set or a one-time password (OTP) that allows a password change. Requiring a user to answer challenge questions, or entering an OTP before receiving the forgotten password, provides an additional level of security.

Forgotten Password requires users to enroll the challenge-response, or enroll the device with the OTP. You can configure the forgotten password settings by performing the following steps.

To enable the Forgotten Password option, ensure that you complete the following:

You can also set up actions that Forgotten Password performs during the password recovery process.

NOTE:If you are using Active Directory when users change their passwords, Self Service Password Reset considers the password history only when the Minimum Password Age is set to 0 and the proxy is disabled. If Minimum Password Age is not 0, it is important that users change the password through the email token to the password history.

Apart from enabling the Forgotten Password feature, configuring the token setting, and configuring actions, you can configure various other settings for this feature. If you want to create different policies for different user groups, you can use the Edit List option and create different profiles. For more information about creating and configuring the profiles see, Configuring a Profile for Forgotten Password Policy.

To configure the Forgotten Password settings:

  1. Log in to Self Service Password Reset at https://dns-name/sspr as an administrator.

  2. In the toolbar, click your name.

  3. Click Configuration Editor > Modules > Forgotten Password > Forgotten Password Settings.

  4. Configure the following settings:

    Enable Forgotten Password

    Allows the users to recover forgotten passwords.

    Forgotten Password User Search Form

    Specify the attributes that users specify to authenticate, such as name or email. Ideally, the information the users specify is not publicly known.

    The system uses these values internally to search for the users who request the forgotten password recovery action.

    Forgotten Password User Search Filter

    Specify a filter to find users. Include each attribute configured in the Forgotten Password User Search Form in the search filter. Strings encoded with a percent sign (%) are replaced with values supplied by the user.

    For example, if the Forgotten Password User Search Form includes email and sn attributes, then the filter would be:

    (&(objectClass=person)(email=%email%)(sn=%sn%))
    Response Read Location

    Specify the location where the system stores the challenge-responses. If you select an option with multiple locations, the system reads each location until it finds a stored response.

    Response Write Location

    Specify the location where the system writes the responses. If you select an option with multiple locations, the system stores responses in each location when users configure their response answers.

    Response Storage Attribute

    Specify an attribute the system uses for storing responses when you want to store responses in the LDAP directory. The system stores responses in the LDAP directory in addition to any other configured storage repositories.

    Response Storage Hashing Method

    Select a hashing method the system uses to store responses from the list. By default Self Service Password Reset uses PBKDF2WithHmacSHA1. The available options are:

    • None (Plaintext)

    • MD5

    • SHA1

    • SHA-1 with Salt

    • SHA-256 with Salt

    • SHA-512 with Salt

    • PBKDF2WithHmacSHA1

    • PBKDF2WithHmacSHA256

    • PBKDF2WithHmacSHA512

    • BCrypt

    • SCrypt

    Storing the responses as plain text facilitates synchronization or migration to other systems.

    NOTE:If an administrator changes this setting and uses the same browser to store the responses, then the changes are not effective. The administrator needs to start a new browser session for the changes to be made effective.

    Forgotten Password Post Actions

    Specify the name of the actions and define the following services to set the actions that must be executed after a user successfully completes the forgotten password process and the user's password gets modified.

    You can also use macros. For more information, see Configuring Macros for Messages and Actions.

  5. Click Save changes.