Password reset - new pwd to be sent to private Mail

[Zod]

Hi,

we r thinking about using the pwd reset.

1st idea is to ask the user via enrollement for a personal email address and some security questions .... . The email then should be confirmed via a confirmation link ... as known from most internet portals.

After authentication is done via the security questions, the new mail should be sent to the private mail.

We are talking about an SSO environment - just it is not sure yet if we directly will be able to connect to the AD Most probably we will be bale to some system/tool that will then connect to the AD.

a) any ideas or hints how to best implement the process via personal mail? Anything to be shared?   Would like to be able to quickly be able showing something ... kind of visual POC

b) is orchestration relevant if we do not connect to a credential store? I assume that we could trigger some tool or script runner without the orchestration to be implemented ...

thank you for some advise & help on that

[dravvyramlochun]

Hello vemffm

Please read the following and this os the process that service now offer.

Self-service Password Reset process: overview

The self-service Password Reset process enables a user to reset the password without assistance from service desk agents.

• This feature works for locally authenticated users who enter the username and password specified in their user record. Users logging in to the instance via an SSO solution or an LDAP integration cannot reset passwords with self-service Password Reset.
• The user must have notification preferences enabled and configured. See Subscription-based notifications. Administrators can modify the email that is sent to the user.

Example: Default self-service password reset flow

1. If a user does not remember the password, the user can click the Forgot Password? link on the login screen.
2. On the Identity page, the user identifies himself or herself by entering a Username.
3. On the Verify page, the user proves that they are the person who is associated with the username. In this example, the user enters the email address that is associated with the user profile. The admin can configure a different verification method or can require additional verifications, for example, a personal question that only the user can answer.
4. The Reset page tells the user to check email for instructions.
5. The user opens the email and clicks the here link to reset the password. The link is valid for 12 hours.
6. The Reset Password page guides the user to reset the password.

How password reset works

Several components in the Self Service Password Reset (com.snc.password_reset) plugin and the Password Reset (com.glideapp.password_reset) plugin control the password reset flow.

• glide.security.forgot_password.display.link	If set to true, displays the Forgot Password? link on the login page.Default: true
  glide.security.password_reset.uri	URI that the user is redirected to after they click Forgot Password?.Default: /$pwd_reset.do?sysparm_url=ss_default

  See Password Reset Properties for a list of all properties.

• Name

  Description

  Default Self Service

  The default process from the Password Reset application (com.glideapp.password_reset). This process defines: The URI that specifies where users are redirected when they click Forgot Password?. By default this value is /$pwd_reset.do?sysparm_url=ss_default, which is the same value used in the glide.security.password_reset.uriproperty. In previous releases, this value was set to/reset_password.do. The Enable Password Reset URL option, which specifies that the user should receive an email with a link to reset their password after they click Forgot Password?. The Personal Data - Enter Email Addressverification flow that specifies the three-step password reset flow.

  See Settings on the Password Reset Details tab for instructions on accessing this form and configuring the fields.

Advanced password reset configuration

You can customize the Password Reset and Password Change applications to meet your organization's needs. See Password Reset and Password Change applicationsor more information. Also see Configure Password Reset properties for a list of properties that control several aspects of password reset.

Troubleshooting the email notification

If the instance does not send the email notification to the user:

• Check the System Event [sys_event] table to see if the email was sent.
• Verify that the user is subscribed to the notification.
• Verify that the Default Self Service password reset process and password reset properties are configured correctly.

Reference:

Self-service Password Reset process: overview

Plan your Password Reset processes

Activate the Password Reset application

Password Reset and Password Change applications

How to send password reset notification to users whose notifications are disabled? Force delivery i...

[Zod]

thank you - but is clearly states, that "Users logging in to the instance via an SSO solution or an LDAP integration cannot reset passwords with self-service Password Reset." ...

We do have SSO. Just I'm not sure if we need the orchestration plugin if we do not directly connect to AD but somehow (vi script runner for example)