3.6 Configuring Challenge-Response Authentication

During the login process, the login page automatically redirects users to the Challenge-Response page. Users set up the responses for challenge questions on this page. When a user forgets their password and tries to reset it, SSPR prompts the configured questions and asks user to specify the correct answer. When the answer matches with the response saved earlier by the user, SSPR will allow the user to reset the password. To configure the challenge-response policy for different profiles, refer Configuring Challenge Response Policy for a Profile

You must select Enable Setup Responses check box to enable SSPR to display the save responses page to users.

3.6.1 Configuring Global Challenge-Response Settings

Apart from configuring random and required questions, you can configure a number of other important settings such as force response setup, case of the responses, Wordlist, and so forth.

To configure the challenge settings, perform the following steps:

  1. In Configuration Editor, click Settings > Challenge Settings.

  2. On the right pane, configure the following settings:

    Field

    Description

    Enable Setup Responses

    Select this check box to display the save responses page to users.

    Force Response Setup

    Select this check box to redirect users to configure challenge-response when they log in. This setting s users to save responses if they do not have stored responses yet.

    Show Response Confirmation

    Select this check box to show the responses to the user after they configure responses. This gives users an opportunity to read and review their responses before submitting.

    Case Insensitive Responses

    Select this check box to make the responses case-insensitive.

    The setting will not affect or apply to users who have already configured their response prior to modifying this setting.

    Allow Duplicate Responses

    Do not select this check box if you want users to enter unique value for each response.

    Save Challenge Query Match (Advanced)

    Specify the query string to detect whether a user can configure challenge-responses. If users do not match this query, then the user responses are not checked, and users are redirected to the forward URL. To view the list of users that match the query, click View Matches.

    Check Responses Query Match

    Specify the LDAP response query.

    If the command servlet is called with the checkResponses command (/private/CommandServlet?processAction=checkResponses), the users are first checked to see if they match the specified LDAP query before the user's password responses is checked. If users do not match this query, then the users responses are not checked, and users are redirected to the forward URL.

    To view the list of users that match the query, click View Matches.

    Minimum Password Lifetime (Advanced)

    When you select this check box, the user cannot change password until the minimum lifetime has completed.

  3. Click Save to save the configuration.