7.3 Configuring Challenge-Response Authentication

During the login process, the login page automatically redirects users to the Challenge-Response page. Users set up the responses for challenge questions on this page. When users forget their passwords and try to reset it, Self Service Password Reset prompts the configured questions and asks the users to specify the correct answers. When the answers match with the responses saved earlier by the users, Self Service Password Reset allows the users to reset their passwords. To configure the challenge-response policy for different profiles, see Configuring a Profile for a Challenge Response Policy

Apart from configuring random and required questions, you can configure a number of other important settings such as force response setup, case of the responses, and so forth.

To configure the challenge settings:

  1. Log in to Self Service Password Reset at https://dns-name/sspr as an administrator.

  2. In the toolbar, click your name.

  3. Click Configuration Editor > Modules > Authenticated > Setup Security Questions.

  4. Configure the following settings:

    Enable Setup Responses

    Enable this option to display the save responses page for users.

    Force Response Setup

    Select this option to redirect users to configure the challenge-response when they log in. This setting allows users to save responses if they do not have stored responses yet.

    Show Response Confirmation

    Select this option to show the responses to the user after they configure responses. This gives users an opportunity to read and review their responses before submitting.

    Case Insensitive Responses

    Select this option to make the responses case-insensitive.

    The setting does not affect or apply to users who have already configured their responses prior to modifying this setting.

    Allow Duplicate Responses

    Do not select this option if you want users to enter unique value for each response.

    Save Challenge Permission

    Define a filter to determine if the permission used is a user that is permitted to configure challenges. The user must be returned during this LDAP query or else the user is not permitted to configure challenges.

    Check Responses Match

    Specify the LDAP response query.

    If the LDAP response query calls the command servlet with the checkResponses command (/private/CommandServlet?processAction=checkResponses), the system first checks the users to see if they match the specified LDAP query before checking the password responses of the users. If users do not match this query, then the system does not check the responses for the users and redirects the users to the forward URL.

    To view the list of users that match the query, click View Matches.

    Enforce Minimum Password Lifetime

    Determine when the users authenticate through ForgottenPassword should have the Password Minimum Lifetime (if set) setting enforced. If you enable this setting, the users cannot change their passwords if the Minimum Lifetime has not passed. If not enabled, the system permits the users to change their passwords when authenticated through Forgotten Password even if the Minimum Lifetime has not changed.

  5. Select Save changes.