Self-Service - Password Self-Service Enrollment Details web action
Overview
This rule sets an identity verification method for Web Portal users to reset a forgotten password and (or) restore access to a locked account. For details, see Configuration of self-service password and profile management.
Supported methods
The rule supports three identity verification methods; all three methods can be enabled at the same time:
Authenticator apps used to generate a time-based one-time passwords (TOTP). Cayosoft Administrator supports TOTP authenticator apps using the RFC 6238 algorithm; the list includes but is not limited to Microsoft Authenticator, Google Authenticator, etc.
Alternative (secondary) email used to receive TOTP codes. Cayosoft Administrator uses the mailbox specified in the Configuration > Settings > Email Settings to send out emails containing one-time codes.
Security questions. You can define a list of questions for the Web Portal user to pick and answer; when locked out or during a password reset attempt, the user answers the question to confirm their identity.
Web action settings
Action section
Setting name |
Description |
|---|---|
Password to encrypt data in AD |
Specify a password to encrypt self-service user data that users specify when enrolling in self-service. Data is encrypted and stored in the accountNameHistory attribute. If you have replication configured, specify the password only on the Publisher server. It will be replicated to Subscriber servers automatically on the next replication rule execution. IMPORTANT Store this password securely. Encrypted data cannot be restored without a password. If you change the password, all existing data will be lost. |
| Authenticator app | |
Enabled |
Set to Yes to allow users to set up a TOTP authenticator app to reset a password or restore access in case of a locked account in Web Portal. |
Alternate email | |
| Enabled |
Set to Yes to allow users to specify a secondary email to receive TOTP codes to reset a password or restore access in case of a locked account in Web Portal. IMPORTANT To enable Cayosoft Administrator to send emails to external mail systems, you must use Exchange Online in Email settings. |
| Verification email template |
Customize the initial enrollment email template. The template uses three macros:
|
| Password reset email template |
Customize the password reset email template. The template uses three macros:
The template is used in both password reset and locked account scenarios. |
| OTP expiration time | Define the expiration period for emailed TOTP codes. When the set period passes, the code becomes invalid; the user must request a new code. The expiration period is set in minutes. |
| Resend code timeout | Define the timeout for TOTP code requests. The timeout is set in seconds. |
| Maximum code resend attempts | Define the maximum amount of Resend code attempts before a temporary lockout. |
| Resend code lockout duration | Define the duration of a temporary lockout after a user reaches the maximum amount of Resend code attempts. |
| Security questions | |
| Enabled | Set to Yes to allow users to select and answer security questions to reset a password or restore access in case of a locked account in Web Portal. The option is enabled by default. |
Minimum answer length (characters) |
Specify the minimum number of characters for answers to the questions used for Self-Service enrollment. |
Number of questions to enroll |
Select the number of questions (from 1 to 5) that the user must answer for Self-Service enrollment. |
Number of questions to authenticate |
Select the number of questions that the user must answer to reset the password or unlock the account. |
| Show/hide answers |
Define the behavior when a user types in an answer to a security question:
The behavior applies both to setting a new answer and replying a security question in case of a lockout. To show or hide the text, click the eye icon to the right of the input field. |
Questions 1−5 |
Specify the list of questions. |
Enable question shared with Help Desk |
When the shared question is enabled, the user is asked to answer one additional question during enrollment. Selected question and the answer provided by the user are stored in reversible encryption format. Question and answer are also displayed in clear text in the Web Portal to a delegated Help Desk person on the Validate User command form. |
Question shared with Help Desk |
Specify the list of questions that will be shared with the Help Desk. |
More Options | |
Password complexity description |
By default, the password complexity description defaults to the setting in the Active Directory extension settings > Password Generation Options section. You can define a custom text for this web action. |
Show/hide password |
Select whether to hide or show the password to a user when a user types it. |
Enforce password domain policies |
Specify whether to enforce the password domain policies for the Change my password web action in Self Service and for I forgot my password link in the login page. Password domain policies include password history, password age, length, and domain complexity requirements. |
Account lockout attempts |
Specify the number of failed answer attempts that cause a user account to be locked out. |
Account lockout period |
Specify the number of minutes that must elapse after a failed answer attempt before a user can try again to answer the questions. |
| Maximum verification attempts | Specify the maximum number of attempts to submit a verification code before a user account is temporarily locked out. |
| Verification code lockout duration | Specify the duration of a lockout cooldown window after the user reaches the maximum verification attempt limit. |
Output section
This section defines the output format of this rule.
To get more information about this section, please see the Rule Output section article.
Version history
| Version | Notes |
|---|---|
| 13.3 | Additional verification methods have been added. The Action section has been updated to move settings related to security questions to a separate subsection. |
Comments
0 comments
Please sign in to leave a comment.