A proxy user is a trusted user who has the required permissions to do the task on behalf of other users without revealing the user's identity. Proxy users are often used for various purposes, including security, access control, and integration.
Self-Service Password Reset (SSPR) integrates with any REST-supporting product and enables external web authentications through REST.
An administrator can configure the proxy user setting in the SSSPR application and provide the LDAP proxy user permission to access the RESTful web services.
By configuring the proxy user, we can restrict direct access to user information or password management functions using REST API from anonymous users or external systems. This provides an additional security layer that minimizes the risk of unauthorized access or misuse of the SSPR system.
Proxy users provide precise control over which individuals or systems can execute SSPR actions through the API. You can assign access rights and permissions to proxy users based on roles and privileges to ensure that only authorized individuals or systems can initiate the SSPR actions for users.
When the administrator configures the LDAP proxy user with the required permissions, then the proxy user can invoke the below REST APIs:
NOTE:When invoking the SSPR REST APIs on behalf of another user, you must provide the username parameter in the API call. This ensures that the API functions in the context of a specified user instead of a proxy user.
If you do not provide a username parameter, then the API will execute the operation for the proxy user.
Check Password
Health
Random Password
Set Password
NOTE:To execute this API, make sure the LDAP proxy user has permission to set the user password.
Signing Form
Statistics
Status
Password Policy
For more information about REST API, see SSPR REST API.
To enable the LDAP proxy user to access the RESTful Web Services, perform the below steps:
IMPORTANT:Create a user in your LDAP directory that Self Service Password Reset uses to access the LDAP directory. The user must have the following rights:
Browse users and manage password attributes of the user object
Create object rights in the new user container (if enabled)
For more information about how to assign the user rights, see Proxy User Rights.
Log in to Self Service Password Reset at https://dns-name/sspr as an administrator.
In the toolbar, click your name.
Click Configuration Editor.
Navigate to LDAP > LDAP Directories > default > Connection > LDAP Proxy User.
Click Add Value to add the LDAP proxy user that SSPR uses to access the LDAP directory.
Click Store Value in LDAP Proxy Password.
Specify the LDAP proxy user password and click the Store Password button.
Navigate to Settings > Web Services > REST Services > Use Proxy User for Web Services LDAP Authentication.
Select Enabled (True).
In the Web Services LDAP Third Party Permissions option, add an LDAP filter that contains the proxy user permitted to execute the REST web services.
Click Save changes.