Unable to reset password since Utah patch 8/9 with security_admin role user

[George Chen]

Hi Community Gurus,

My organisation has upgraded sub-instances to Patch 9 hotfix 1 (previously Patch 7 hotfix1) but since the patch, existing with security_admin role can no longer go through password reset process like forgot password, and when new password is submitted, it raises error in the backed.

Error: Disallowing setting of password for user with security admin. Change must be done by another security admin. The update has been cancelled.

Here are my additional exploration in our environments

• This appears impacting users inheriting security_admin role
• By removing the role, the reset comes through (password reset)
• By creating a blank new user with admin/security_admin role, the password reset process come through as expected.
• So far, the impacted customers are ServiceNow admin team who inherit security_admin role (my team folks)
• I could not replicate in PDI running Patch 7 hotfix1
• This does not replicate in UAT Patch 7 hotfix1 (our UAT)
• When password reset fails, logs can be seen that ‘Disallowing setting of password for user with security admin. Change must be done by another security admin. The update has been cancelled.  
• From surface, this does seem to relate to the patches (suspicious problem- password security flaw fix
  

  Password Reset /PRB1675902 )

• Steps to produce:
• As any of existing users inherits security_admin role
• Go through forgot password process on login page
• Complete user identity process -> receive the email.
• Fill in password that meets the requirement and then submit

Error occurs as described above.

Thank you for taking your time with the issue and any advice would be appreciated.

Best wishes,

George

[George Chen]

Thanks Sumanta.  I've walked through potential customisation with my colleague and did not get any impression this was caused by the custom changes but about to raise a HI ticket since the official release notes only provide high level details password security flaw fix

Password Reset /PRB1675902 )

[Dr Atul G- LNG]

Hi @George Chen 

Best is log a Now Support case , as it is related to security so dont delay. 

[George Chen]

Thanks Kilo for the suggestion.  Yes, I was thinking of raising HI ticket but just checked with Community first. Now I am about to do so! Thanks

[Dr Atul G- LNG]

Hi @George Chen 

If you get some feedback, please share with community.