Users can change their passwords whenever they want by using Self Service Password Reset. Self Service Password Reset allows administrators to customize the password change experience from begging to the end for users. You can configure things users must do before changing their password and you can configure tasks the users must perform after they changed their passwords. For example, users must provide their current password before they can change their password.
When the users click Change Password, the web page lists the prerequisites for users to change their password. If you want to change the text from the listed items, Self Service Password Reset allows you to do that. For more information, see the Password Rule Text setting in Configuring a Profile for Password Policy.
To configure the Change Password settings:
Log in to Self Service Password Reset at https://dns-name/sspr as an administrator.
In the toolbar, click your name.
Click Configuration Editor > Modules > Change Password.
Configure the following settings:
Specify the query for the users who are allowed to change their password. You can query by using Add Filter that includes the object class, and by using Add Group that includes the LDAP group.
Enables the system to log out the user after changing a password. For security reasons, enable this feature for all users especially if a user is using a single sign-on service.
Specify the values required to be entered before changing the password.
Requires users to provide their current passwords on the Change Password page. You must enable this option if users are using a single sign-on service. In most cases, this is not required because the single sign-on service authenticates the users prior to accessing the Change Password page.
Specify the message to display to users before being allowed to change the password. The message can include HTML tags. If you leave this field blank, the Change Password Agreement page is not visible to users. You can use macros in this setting. For more information, see Configuring Macros for Messages and Actions.
You can also configure this setting in a different language. Select the required language from the list, then click Add Locale.
Specify the message that Self Service Password Reset displays to users when users complete the password change process. If you leave this setting blank, the user does not see the change password completion page. This message might include HTML tags. You can also use macros. For more information, see Configuring Macros for Messages and Actions.
You can also configure this setting in a different language. Select the required language from the list, then click Add Locale.
Specify the text (in HTML) Self Service Password Reset displays for the Password Guide page. This shows up as a password guide link in a pop-up dialog. Leave blank to not show the password guide link. You can use macros for this setting. For more information, see Configuring Macros for Messages and Actions.
You can also configure this setting in a different language. Select the required language from the list, then click Add Locale.
Specify the time, in seconds, required for a password change to take effect. The system uses this time for background synchronization processes.
Enables replica sync checking that polls all of the configured replicas on the users LDAP Profile to determine if the password change time has been updated. The particular method to determine the last password change time varies per LDAP vendor type.
Specify the maximum time in seconds the system waits for the password to be synchronized to all configured LDAP servers during a password change action. This setting prevents the page from timing out when the synchronization takes longer time.
Specify the number of seconds before the users’ passwords expire, which forces the users to change their passwords. If the users’ passwords expire within this time frame, the system behaves as if the users’ passwords had already expired.
Setting this value to a day prevents most cases when the users passwords expire while they are logged in. The recommend setting for this value is 86400 (1 day).
Specify the time in seconds that Self Service Password Reset sends the password expiry notification before the users’ passwords expire. If the users’ passwords expire within this time frame, the system warns the users during a CommandServlet, checkExpire, or checkAll operation.
To disable this feature set the time to 0 or less than expirePreTime. The recommended value for this setting is 432000 seconds (5 days).
Enables the system to verify whether the users’ passwords are expired or about to expire while the users authenticate. If the password is expired, the system forwards the user to the Expired Password page.
Specify the actions to be taken when a user changes a password. The system invokes the configured actions immediately after the user changes the password. You can use macros within the action. For more information, see Configuring Macros for Messages and Actions.
When you add an action, following are the services available to set the actions:
You can select the HTTP method, add headers and specify the web service URL.
You can specify the LDAP attribute name, attribute value, and the type of the operation that is performed. The operation types are:
Replaces the existing values and include the new ones in the output.
Adds the new values along with the existing values in the output.
Removes the specified value in the output.
The user web page displays a link to users during the change password process to display a list of auto-generated sample passwords that are allowed by the configured password policies. The users have the option to select and use one of the values in the list. If you enable this option, the users are not forced to choose a password from the list.
Displays the strength meter, for the password strength, on the Change Password page.
Click Save changes.