Configure Password Reset

Specify the availability of the password reset functionality.

• Select Windows logon screen to make the functionality available on the Windows logon screen. Password resets on the Windows logon screen is managed through the Windows Client. This requires that you install the Windows Client on each computer on which you want to offer the password reset functionality.
• Select Web Portal logon screen to make the password reset functionality available in the Web Portal.
  • Select Include captcha validation to provide extra security. Captcha validation is only available for the Web Portal.
• Select Mobile clients to make the password reset functionality available in the mobile client.

Specify the text of the password reset link.

Specify the identification method of users when they request a password reset.

Specify the service that is delivered as part of the password reset (for example, the service Reset password based on user input that is provided with the Identity Director Password Reset Guide).

Specify instructions when users click the password rest link.

Specify status information.

Specify a URL of choice after a password reset, rather than the default Web Portal sign-in page.

In certain scenarios, for example when users access the Web Portal from a thin client, redirecting them to the default page may not be user-friendly. You can prevent this by specifying a different URL.

Specify if password input is provided through the wizard or through a service workflow.

Specify the service attribute that can store the password that the user provides.

• This field is only available if input is provided through the wizard.
• You can only select service attributes that are part of the service you selected in the Service field.

Configure a password complexity policy. This ensures that passwords provided by your users meet the complexity requirements of your organization.
This area is only available if input is provided through the wizard.

• In the Regular expression field, configure the regular expression that determines the password complexity requirements. In the Web Portal, the provided password by the user is validated according to this regular expression.
  • When you configure a regular expression, you can add flags to the pattern.
  • You can split complex rules in multiple rules, to make it easier to configure the desired policy.
  • Verify the regular expression in the Test field. Green and red coloring indicate if the text field is conform the configured regular expression.
• In the Password complexity hints field, provide users with information about the characteristics of the new password. In the Web Portal and Windows Client, if the provided password matches a regular expression, the related complexity hint will be marked.

Enable verification code validation.

Specify the service that generates the code and sends it to the user, for example via SMS or e-mail.

• The delivery workflow of the specified service must contain a Provide Verification Code action. In this action, we recommend to specify a verification code of up to a maximum of 20 characters. Because the code is encrypted, longer codes may exceed the maximum value. This will result in an error and leave the transaction in a Pending state.
• If you use SMS for code validation, the mobile phone number of the user that requests the password reset must be registered in your environment.
• To generate a random PIN for this service, you can create a service attribute on the Attributes tab. It is best practice to leave the initial value blank, let its value be set by a Set Service Attribute action and use the function @[RANDOM(x,y)] in its Manual value field. This generates a random PIN every time the service is requested.
  
  You may also consider adding a Jump action to the workflow, so it jumps back to the Set Service Attribute action if the user provides an incorrect PIN. This generates a new random PIN.

Limit the number of attempts a user can make to provide a verification code during a password reset. This ensures that password resets occur as secure as possible.

Configure the maximum number of attempts a user can make to provide a verification code during a password reset. This field is only available if you have selected the option Limit number of attempts.

• You can configure a number from 1-999.
• The number of attempts left is shown in the Web Portal and the Mobile Client.
• If the user exceeds the limit, the workflow action in the service that validates the verification code, fails automatically.

Specify the Organization(s) or Organizational attribute(s) that determine if the Verification Code applies to a user.

• If you specify multiple Organizations, these are treated as 'AND': all must be true for the Verification Code to apply.
• If you specify multiple Organizational attributes, these are treated as 'AND': all must be true for the Verification Code to apply.
• If you specify both Organizations and Organizational attributes, these are treated as 'OR': either all organizations OR all organizational attributes must be true for the Verification Code to apply.

After you specify organizational context, the first (max) 100 people that meet the conditions are listed here.
You can also search for a specific person, to verify they meet the conditions.

Specify status information that is displayed to the user about generation of the code.

Specify user instructions to validate the code.

• The password reset can only continue after a successful validation.

Specify the message that is that is displayed to the user if the provided code is incorrect.

Specify the message that is that is displayed to the user when he exceeds the limit. This field is only available if you have selected the option Limit number of attempts.

Specify status information about validation of the code.

Specify the number of questions in the wizard.

If this number exceeds the number of questions and answers stored in a user's Security Questions and Answers attribute (see below), the user will get an error and cannot complete the Password Reset service.

This field shows the default people attribute Security Questions and Answers that stores the security questions and answers of the wizard. The attribute can be filled using the User Validation Service you specify on the Login Page Services page.

• If you configure a custom service to define security questions and answers, make sure it fills this attribute with the security questions and the answers that were provided by the user.

Specify the Organization(s) or Organizational attribute(s) conditions that determine if the Security Questions apply to a user.

• If you specify multiple Organizations, these are treated as 'AND': all must be true for the Security Questions to apply.
• If you specify multiple Organizational attributes, these are treated as 'AND': all must be true for the Security Questions to apply.
• If you specify both Organizations and Organizational attributes, these are treated as 'OR': either all organizations OR all organizational attributes must be true for the Security Questions to apply.

After you specify organizational context, the first (max) 100 people that meet the conditions are listed here.
You can also search for a specific person, to verify they meet the conditions.