Self Service Password Reset enables you to configure settings to control interactions of Self Service Password Reset with the LDAP directory that contains your users. You can select a template to configure the settings. Self Service Password Reset provides templates to set default settings for your back-end directories. Changing the template only affects default values. You can change the template at any time. Changing a template does not affect the modified settings.
Self Service Password Reset provides the following templates for supported directories:
Active Directory
Oracle Directory Server
Identity Manager/ OAuth Integration
To configure Identity Manager/ OAuth Integration see, Identity Manager and Section 11.0, Integrating Self Service Password Reset with NetIQ Identity Manager and Section 9.0, Integrating Self Service Password Reset with NetIQ Access Manager.
Use the following information to configure the settings for the other LDAP directory templates.
The Global settings control the interaction with an LDAP directory. These settings are not applicable to the user's LDAP profile. For more information about configuring LDAP for a profile see, Configuring LDAP Directory Profile.
To configure the Global LDAP settings:
Log in to Self Service Password Reset at https://dns-name/sspr as an administrator.
In the toolbar, click your name.
Click Configuration Editor.
Select the LDAP directory template for your LDAP directory.
Click Default Settings > LDAP Vendor Default Settings, then select the LDAP directory you are using.
NOTE:If you select NetIQ eDirectory, you can configure NMAS settings. See, Configuring NetIQ eDirectory Settings.
In the toolbar, click Save changes.
In the toolbar, click your name.
Click Configuration Editor.
Click LDAP > LDAP Settings > Global.
Use the help information to configure the global settings for the LDAP directories.
In the toolbar, click Save changes.
Self Service Password Reset allows you to change the settings for Microsoft Active Directory.
To change the Microsoft Active Directory settings:
Log in to Self Service Password Reset at https://dns-name/sspr as an administrator.
In the toolbar, click your name.
Click Configuration Editor.
Click Default Settings > LDAP Vendor Default Settings > Microsoft Active Directory.
Select LDAP > LDAP Settings > Microsoft Active Directory.
Configure the Active Directory settings use the help.
In the toolbar, click Save changes.
You can use either eDirectory or eDirectory with NMAS as the back-end directory. These settings allow you to change the eDirectory setting configuring during the Configuration Guide.
When the back-end directory is eDirectory, you can configure NMAS. All NMAS operations require an SSL connection to the directory. Benefits of this configuration include:
Validation of passwords against the NMAS password policy.
Email notifications for failed password operations, such as when a password coming from a connected system does not comply with the password policies.
Better error messages when using universal password policies
Better error handling during the change password process
If you must apply the policy settings for the challenge sets that you configured in NMAS, perform the following:
To change the policy settings for the challenge sets:
Log in to Self Service Password Reset at https://dns-name/sspr as an administrator.
In the toolbar, click your name.
Click Configuration Editor.
Click LDAP > LDAP Settings > NetIQ eDirectory > eDirectory Challenge Sets.
Define the eDirectory challenge sets using the help.
In the toolbar, click Save changes.
Apart from configuring the NMAS extension, you can configure some additional parameters for eDirectory.
To configure NetIQ eDirectory:
Log in to Self Service Password Reset at https://dns-name/sspr as an administrator.
In the toolbar, click your name.
Click Configuration Editor.
Click Default Settings > LDAP Vendor Default Settings , then select NetIQ eDirectory.
Click LDAP > LDAP Settings > NetIQ eDirectory > eDirectory Settings.
Configure eDirectory settings using the help.
In the toolbar, click Save changes.
Self-Service Password Reset evaluates the strength or entropy of a password based on its length and the number of characters it contains. This computes how easy or difficult it is for an attacker to crack the new password through guessing or other possible fraudulent methods.
When a user changes the password, the entropy calculator evaluates the strength of specified password. You can use the evaluated strength to automatically apply specific password policy defined in eDirectory and determine the expiration date of the password mapped to a specific user account.
Before configuring entropy based policy, navigate to Configuration Editor > Modules > Authenticated > Change Password and ensure that your setup meets the following prerequisites:
Show Strength Meter is enabled.
Strength Meter Algorithm is set to Nist - Entropy calculator.
NOTE:The Password Entropy functionality can be used with any strength meter algorithms. It works with other algorithm but might not We recommend you to configure Entropy with Nist - Entropy calculator.
To configure entropy based policy and display the password expiration interval:
Log in to Self Service Password Reset at https://dns-name/sspr as an administrator.
Navigate to Configuration Editor > LDAP > LDAP Settings > NetIQ eDirectory > eDirectory Settings.
Enable the Enable Entropy based Policy option.
In Entropy based Policy Mapping, perform the following:
Move the slider and set the minimum value for the following category:
Low
Medium
High
Very High
The value set for each category represents the minimum threshold for each category. The evaluated password strength of a password is used to determine and align to the corresponding category. The password strength is measured in bits.
NOTE:While you set the minimum value for each category, ensure that the value is equal or higher than the lower category.
For example, if the minimum value for the category Low is 20, then the minimum value must be higher than 20 for the category Medium.
Click Add LDAP Policy against each category and select the appropriate password policy.
(Conditional) If you want to display the password validity period on the Change Password screen, select Display Expiry interval during change password. This displays the duration until when the password is valid to users while the users set the password on the Change Password screen
By default, the Display Expiry interval during change password option is disabled.
Click Save changes in the toolbar.
Consider that Thomas is an administrator of an organization and he is required to achieve the following:
Implement the following requirements for the password:
Minimum number of characters: 8
Allow special characters
Allow spaces as characters
Allow pass phrases
Restrict commonly used passwords (for example, p@ssw0rd and other common phrases)
Restrict contextual specific passwords (for example, user’s first name or personal attributes)
Assign the password policies of eDirectory for each password strength range. The password strength range is calculated using Entropy algorithm as follows:
|
Password Strength Range (in bits) |
Map to the eDirectory Policy |
|---|---|
|
28 to 50 |
60 days Password policy |
|
51 to 100 |
90 days Password policy |
|
101 to 112 |
180 days Password policy |
|
113 to any value |
200 days Password policy |
NOTE:If the password strength is less than 28 bits then it is considered as very low category. You can configure password reject policy for very low category as per your requirement using the Minimum Password Strength configuration. The Password Strength configuration restricts the passwords strength falling below the configured Low category threshold.
For more information about Minimum Password Strength configuration, see Configuring Password Policies.
Thomas must perform the following steps to achieve the preceding requirements:
Log in to SSPR as an administrator.
Navigate to Configuration Editor > Modules > Authenticated > Change Password.
Select Display Phrases in Randoms to allow users to set multiple words with space as the password. For example, train engines.
Select Nist - entropy Calculator from Strength Meter Algorithm.
Navigate to LDAP > LDAP Settings > NetIQ eDirectory > eDirectory Settings.
Select Enable Entropy based Policy to calculate the strength of user-specified password using the entropy calculator and map a policy to each category.
Set the minimum value and map the corresponding policy for each category as follows:
|
Category |
Minimum Value |
eDirectory Policy |
|---|---|---|
|
Low |
28 |
60 days Password |
|
Medium |
51 |
90 days Password |
|
High |
101 |
180 days Password |
|
Very High |
113 |
200 days Password |
Select Display Expiry interval during change password. This displays the password validity duration while the users set the password on the Change Password screen.
Save changes.
After Thomas configures the password entropy policy, the following are possible scenarios for end-users:
|
Scenario |
Calculated entropy |
eDirectory Policy |
Result |
|---|---|---|---|
|
A user specifies encourage as the password in the Change Password screen |
26.5 |
Reject Password |
User is required to set a new password. NOTE:The SSPR rejects the password only if the Minimum Password Strength is configured. For more information about Minimum Password Strength configuration, see Configuring Password Policies. |
|
A user specifies encourage77 as the password in the Change Password screen |
34 |
60 days Password policy |
Password is set and a message password expires in 60 days is displayed to the user. |
|
A user sets the password as encouragement@123 in the Change Password screen |
62.7 |
90 days Password policy |
Password is set and a message password expires in 90 days is displayed to the user. |
|
A user sets the password as Electronic Communication@123 in the Change Password screen |
105.3 |
180 days Password policy |
Password is set and a message password expires in 180 days is displayed to the user. |
|
A user sets the password as Electronic&Electrical Communication in the Change Password screen |
130.8 |
200 days Password |
Password is set and a message password expires in 200 days is displayed to the user. |
Self Service Password Reset allows you to change settings for the Oracle Directory Server setting.
To change the Oracle Directory Server settings:
Log in to Self Service Password Reset at https://dns-name/sspr as an administrator.
In the toolbar, click your name.
Click Configuration Editor.
Click Default Settings > LDAP Vendor Default Settings > Oracle Directory Server.
Select LDAP > LDAP Settings > Oracle DS.
Configure the Oracle Directory Server settings using the help.
In the toolbar, click Save change.