Self Service Password Reset sends tokens through email and SMS for secure user authorization. You can configure Self Service Password Reset to send a random token in different scenarios such as during a new user registration and forgotten password recovery. For example, when users try to reset their passwords, Self Service Password Reset prompts them to specify answers to the challenge-responses and sends a token through an email or SMS to the email ID or phone number specified by the user. The user must enter this token into the Password Change form. When the token matches with the token sent by Self Service Password Reset, the system changes the user's password.
Self Service Password Reset also sends tokens for new user registration confirmation.
NOTE:The SSPR session is specific to the browser that is being used. If the user copies the email verification link provided in the email manually, it is recommended to paste the email verification link into the same browser session in which the user initiated the SSPR process.
To configure token settings:
Log in to Self Service Password Reset at https://dns-name/sspr as an administrator.
In the toolbar, click your name.
Click Configuration Editor.
Click Settings > Tokens.
Use the help to configure the settings for tokens.
In the toolbar, click Save changes.
This feature enables the users to verify an email tokens from a different browser session than the one from which they initiated the user activation process. Verifying email tokens across sessions ensures that the user can seamlessly transition from one session to another without losing progress or encountering authentication issues.
NOTE:This feature is only available for the User Activation module.
If a user starts the user activation process but later switches to a different browser session (e.g., due to a browser crash or intentionally opening a new tab), they should be able to continue where they left off.
Additionally, you can force users to verify that they are a human or a robot using the Google reCAPTCHA after user activation email token verification in different browsers.
The following example scenarios describe how this feature works:
Scenario 1: A user Maria initiates Self Service Password Reset User Activation process in a Chrome browser on the system. However, Maria copies the email verification link provided in the email manually and pastes the email verification link into the Firefox browser session window. Then if the Allow Token Verification in a Different Browser Session feature is enabled, Maria can verify that email token in the Firefox browser.
Scenario 2: A user Paul starts the SSPR User Activation process on his home laptop but realizes he needs to leave. Later, he continues the process on his tablet to verify the email token. If the Allow Token Verification in a Different Browser Session feature is enabled, he can be able to verify that email token through his tablet.
By default, SSPR does not allow users to verify their email token in a different browser than the one from which they initiated the user activation process. To use a different browser for the user activation email token verification, perform the following steps:
Login to Self Service Password Reset at https://dns-name/sspr as an administrator.
In the toolbar, click your name.
Click Configuration Editor.
Click Settings > Tokens.
Enable the Allow Token Verification outside the Browser Session option.
Enable the Verify ReCaptcha Post Token Verification option, if you want to force users to verify that they are human or robot. If this option is enabled. It stops bots from completing the user Activation process.
NOTE:This option is only applicable only if the Allow Token Verification in a different Browser Session option is enabled.
Navigate to Settings > Captcha.
Select the User Activation page in the CAPTCHA Protected Pages to protect user activation page using CAPTCHA after token verification in another browser.
NOTE:If the Verify ReCaptcha Post Token Verification option is not enabled and only the User Activation page is selected in the CAPTCHA Protected pages option, then email token verification in a different browser will be unsuccessful.
Select the required reCAPTCHA Mode from the list.
In the toolbar, click Save changes.