Password Reset Enrollment - Issue

[miles9]

Hi, 

We have a sub-prod instance in which we are trying to get a better understanding of the Password Reset module.  In particular we are working on the Password Enrollment module. 

The issue we are having is upon submitting questions and answers for a person enrolling.  After choosing and filling out questions, the submit button does not do anything.  If we don't select the required number of questions and then click the submit button, it notifies us that we have to select X number of questions.  If we don't answer all the questions it notifies us that we have to answer all the questions.  If our answers are not at the minimum length it notifies about that.  

But if you answer everything and fill out the answers properly and you select the required amount of questions the submit button does nothing.  

This is out of box as well.  So we've been searching in our instance as to what the issue is.  At first we thought it was the script/code but when modifying it, it still did nothing.

I've now tested with my PDI and I see that out of box works fine.

A few notes, on the password enrollment screen for the PDI I see the response time icon in the bottom right corner, in our development instance that does not show.  In the PDI, it correctly changes the title to Password  Reset - Enroll.  In our development instance it says ServiceNow.  It doesn't even change.  The last thing I noticed is in my PDI the field for answer is correctly disabled until a question is selected.  In our development instance, the answer field is enabled from the start.  If you choose an question AND then select "select a question" the answer field is disabled.

Any ideas that could point somewhere would be welcome.

Thank you

[Abhishek Pal]

Hi @miles9 ,

Based on the comparison with your PDI, I would not focus on the Security Question configuration itself first.

The important clues are:

- The PDI works OOB.
- Your sub-production instance behaves differently.
- Required-question validation is working.
- Required-answer/minimum-length validation is working.
- Submit does nothing only after all data becomes valid.
- The Answer field is enabled immediately in sub-prod but disabled until a Question is selected in the PDI.
- The page title/behavior also differs between the two instances.

This strongly suggests that the Password Reset enrollment UI components in the sub-production instance are not at the same OOB baseline as the working PDI.

The final submission involves more than only the question UI script, so modifying one script may not fix the issue.

I would troubleshoot it in this order.

1. Verify the Security Questions Verification Type

Navigate to:

Password Reset
-> Extensions
-> Verification Types

Open:

Security Questions

For manual enrollment, verify that the OOB enrollment components are configured correctly.

Check:

Automatic enrollment = false

Enrollment UI:
$pwd_enroll_questions_ui

Enrollment Processor:
PwdEnrollQuestionsProcessor

Enrollment Check:
PwdQuestionsEnrollmentCheck

Do not point these fields to copied/custom versions while troubleshooting.

The Enrollment UI is responsible for collecting the question/answer data.

The Enrollment Processor is responsible for actually creating/updating the enrollment when Submit is processed.

2. Check the OOB enrollment page

The Password Reset enrollment container is:

$pwd_enrollment_form_container

Compare this UI Page between:

Working PDI
and
Sub-production

Do not compare only the visible HTML.

Compare:

- HTML/Jelly
- Client Script
- Processing Script
- Updated by
- Updated date
- Customer Update history

If this page was customized in sub-production, that would also explain why the title and other UI behavior differ from the PDI.

3. Compare the Security Question enrollment UI components

The Password Reset application installs dedicated components for QA enrollment.

Compare these with the working OOB instance:

$pwd_enroll_questions_ui

and its associated Password Reset enrollment JavaScript.

Also check:

$pwd_enrollment_submit_event

This one is especially important.

The enrollment submit event script participates in processing the final enrollment submission.

Your current symptoms are consistent with this sequence:

Question validation
-> Working

Answer validation
-> Working

Final Submit event
-> Not completing

Therefore, I would specifically compare $pwd_enrollment_submit_event between the working PDI and sub-production.

4. Check whether Submit actually sends anything

Open Browser Developer Tools.

Go to:

Network

Then complete all required Question/Answer fields and click Submit.

Check whether a request is generated.

Scenario A:

No request is generated after clicking Submit

This strongly points to a client-side enrollment/submit-event problem.

Focus on:

$pwd_enrollment_submit_event
$pwd_enroll_questions_ui
$pwd_enrollment_form_container

Also check the browser Console for JavaScript errors.

Scenario B:

A request is generated but fails

Then check:

System Logs > All

and inspect the transaction/error.

At that point investigate:

PwdEnrollQuestionsProcessor

and the enrollment data being submitted.

This test is much more useful than modifying scripts blindly.

5. Check Upgrade History / Skipped Records

This would be one of my highest-priority checks because the PDI works while the long-lived sub-production instance does not.

Navigate to:

Admin Center
-> Upgrade Management
-> Upgrade Monitor

Review skipped records from previous upgrades.

Search for Password Reset records containing names such as:

pwd_enroll
pwd_enrollment
PwdEnroll
pwd_reset

If an OOB Password Reset UI Page, UI Macro, UI Script, or Script Include was customized in the past, ServiceNow may have preserved the customized version during an upgrade and skipped the newer OOB version.

That can produce exactly this type of situation:

Current server-side Password Reset framework
+
Older customized enrollment UI
=
Partial functionality / Submit failure

If you find skipped Password Reset records, compare:

Base system version
vs.
Your customized version

If there is no longer a business requirement for the customization, revert to the current OOB version.

Do this first in sub-production.

6. Check Customer Updates

Also search:

sys_update_xml.list

for:

pwd_enroll
pwd_enrollment
PwdEnrollQuestionsProcessor

This will show whether any of those OOB artifacts were customized locally.

Do not delete the Customer Update records manually.

Use the normal Upgrade History / skipped-record resolution process to reconcile the customization.

7. Verify the Security Question parameters

Open:

Password Reset
-> Verifications
-> Security Questions

Check the Password Reset Verification Parameters.

Pay particular attention to:

num_enroll

This determines the number of questions the user must configure during enrollment.

For example:

num_enroll = 5

Make sure:

num_enroll > 0

and:

num_enroll <= number of available Security Questions

Your existing validation appears to recognize the required count, so this is probably not the primary issue, but it should still be validated.

8. Test with a clean user

Use a test user that has never enrolled in Password Reset.

Do not initially test with a user that may already have partial enrollment records.

Password Reset stores enrollment information in records including:

pwd_enrollment
pwd_active_question
pwd_active_answer

Do not manually delete production enrollment data simply for troubleshooting.

Use a clean test user first.

9. Compare on the same release/patch

If possible, compare against an instance running the same:

- Family release
- Patch level
- Password Reset application/plugin version

A newer PDI can contain newer OOB Password Reset components than an older sub-production instance.

The most useful comparison is therefore:

Working OOB instance on same version
vs.
Problem instance

10. What I would NOT do

I would not:

- Rewrite PwdEnrollQuestionsProcessor
- Create a custom Submit button
- Clone the Password Reset enrollment page
- Add DOM manipulation
- Modify the database enrollment records directly
- Keep changing OOB scripts until Submit starts working

The fact that the PDI works OOB strongly suggests that you first need to identify which OOB component in the sub-production instance differs from baseline.

My recommended troubleshooting sequence is:

Security Questions Verification Type
-> Verify OOB Enrollment UI/Processor
-> Compare $pwd_enrollment_form_container
-> Compare $pwd_enroll_questions_ui
-> Compare $pwd_enrollment_submit_event
-> Browser Network/Console test
-> Review Upgrade skipped records
-> Restore/merge OOB components
-> Retest with a clean user

From the symptoms you provided, I would investigate $pwd_enrollment_submit_event and any skipped/customized Password Reset UI artifacts first.

The difference where the Answer field is enabled before selecting a Question is another strong indicator that the sub-production enrollment client-side components are different from the current OOB implementation.

Hope this helps!

If this response helped, please mark it as Helpful.
If it resolves your issue, please Accept it as Solution.

Kind Regards,
Abhishek Pal