Configuration of self-service password and profile management

Overview

In Cayosoft Administrator, you can delegate permissions to users to change their password or update their account profile as a self-service activity. Additionally, users can use a built-in feature to reset a forgotten password or unlock their account. In order to use the features, the user must pick an option to verify their identity; when the user forgets a password, the verification method is used to authenticate them and allow them to create a new password or restore access to their account. This article covers the setup process for the Self-Service - Password Self-Service Enrollment Details rule required to allow manual password reset and account unlocking in Web Portal and relevant settings.

Refer to the recommended steps to configure self-service features in your Cayosoft Administrator environment:

1. Configure the Self-Service - Password Self-Service Enrollment Details rule.

   1. Set a data encryption password.

   2. Set up supported verification methods.

   3. Define lockout parameters for security.

2. Delegate the Self-Service virtual admin unit.

3. Configure user notification rules.

   • AD Group Manager | Group Management Self-Service Notification rule

   • AD Users | Self-Service Enrollment Welcome Notification rule

   • AD Users | Self-Service Enrollment Reminder Notification rule

Additional information

• Self-service enrollment details for each Active Directory user are encrypted and stored in Active Directory in the AccountNameHistory attribute of each enrolled user. E.g., the data stored in the AccountNameHistory attribute is encrypted questions and answers, and the date and time of both welcome and reminder notifications.

• You can set up additional password policies to govern the password complexity. Use Password complexity description and Enforce domain password policies settings to both guide the user and enforce password requirements when changing a password and restoring a forgotten password.

  TIP    Password age determines the period of time (in days) that a password must be used before the user can change it. By default in the domain password policy the Password Age is set to one day. It means that a user can reset his password only a day after the password was set. If a user tries to reset it earlier he will get the general error: The password does not meet the length, complexity, or history requirement of the domain.

• The following errors are prompted when a user exceeds the maximum number of attempts to restore a password or unlock an account:

  You have made too many attempts. Please wait and try again later.
  You have made too many unsuccessful sign-on attempts. You have been temporarily locked out of the portal. Please wait then try again later.

Configure self-service enrollment rule

The Self-Service - Password Self-Service Enrollment Details rule controls the self-service enrollment routine and the ability to restore access by end users. Only a user assigned a Global Administrator role in Cayosoft AdministratorGlobal Administrators Role can set up the rule.

Set data encryption password

1. Open the Cayosoft Administrator console.

2. Navigate to Configuration > Web Portal > Web Actions > Common > Self-Service - Password Self-Service Enrollment Details.

3. Locate the Password to encrypt data setting.

4. Click the ... button to the right side of the field and enter a password that used to encrypt user answers.

5. Click OK > Save Changes.

Set up supported verification methods

Cayosoft Administrator provides three verification methods to confirm the identity of the end user in case of a forgotten password or a locked account:

• Authenticator app used to generate a time-based one-time passwords (TOTP). The option is governed by the Authenticator app subsection.

• Alternative (secondary) email used to receive TOTP codes. The option is governed by the Alternate email subsection.

• Security questions. The option is governed by the Security questions subsection.

The rule requires at least one enabled method to allow the password reset/self-service account unlock.

Set up verification methods

Authenticator app

To allow users to set up a TOTP authenticator app to reset a password or restore access in case of a locked account, set the Authenticator app > Enabled setting to Yes. Additionally, you can set up method-specific limits to prevent tampering:

• Set the Maximum verification attempts setting to set the maximum number of times a wrong verification code can be specified.

• Set the Verification code lockout duration setting to define the cooldown period when no verification code is accepted to throttle the login attempts.

The OTP code expiration time and code renewal are governed by the RFC 6238 algorithm and the application the user decided to enroll with.

NOTE    The process of enrolling is described in the following article: Process for end user to enroll and reset a forgotten password.

Alternative email

To allow users to specify a secondary email to receive TOTP codes to reset a password or restore access in case of a locked account, set the Alternate email > Enabled setting to Yes. The method supports the following settings:

• Define OTP expiration time to limit the code validity duration.

• Define Resend code timeout to throttle code resend attempts.

• Define Maximum code resend attempts to limit the code requests.

• Define Resend code lockout duration to define the cooldown period when no verification code is sent.

• Set the Maximum verification attempts setting to set the maximum number of times a wrong verification code can be input.

• Set the Verification code lockout duration setting to define the cooldown period when no verification code is accepted to throttle the login attempts.

Additionally, you can customize the email templates sent out to users when a code is requested. Templates use the following three macros:

• $UserName for the first name of the user.

• $VerificationCode for the verification code.

• $FormOtpExpirationTime for expiration time for the TOTP code.

Security questions

To allow users to set up security questions to reset a password or restore access in case of a locked account, set the Security questions > Enabled setting to Yes. The method supports the following settings:

• Define Minimum answer length to enforce the minimum length of answers provided by the end user during enrollment. By setting a higher number for answer length, the complexity of the answers will be increased.

• Define Number of questions to enroll to enforce the number of questions a user must answer during the enrollment. and later when using the forgotten password service

• Define Number of questions to authenticate to enforce the number of questions a user must answer to confirm their identity. If the number is lower than the Number of questions to enroll, random questions will be prompted.

• In Questions 1−5, each question field is presented to the user during enrollment as a drop-down list of questions from which they may choose. Update the lists of questions to grant more options to users.

• When the Enable question shared with Help Desk settings is enabled, the option adds a question that must be answered by the user during enrollment. The question and the answer provided by the user are made available to anyone delegated the permissions to use the Validate User Identity web action in the Web Portal.

• Set the Account lockout attempts value to set the maximum number of times a wrong password can be input.

• Set the Account lockout period setting to define the cooldown period when a user reaches the maximum number of attempts; no attempts to reset a password or unlock an account will be made possible during the cooldown.

TIP    To change the default questions, simply change an existing question or add additional questions separated by the | symbol. Each question should elicit an answer that is not easily guessed, or that may be easily found in public sources.