Self Service Password Reset sends tokens through email and SMS for secure user authorization. You can configure the Self Service Password Reset to send a random token during a new user registration, forgotten password recovery, etc. For example, when users try to reset their passwords, Self Service Password Reset prompts them to specify answers to the challenge-responses and sends a token through an email or SMS to the email ID or phone number specified by the user. The user must enter this token into the Password Change form. When the token matches with the token sent by Self Service Password Reset, the system changes the user's password.
Self Service Password Reset also sends tokens for new user registration confirmation.
NOTE:The Self Service Password Reset session is specific to the browser used. If the users copy the email verification link provided in the email manually, it is recommended that the users paste the email verification link into the same browser session in which they initiated the Self Service Password Reset process.
To configure token settings:
Log in to Self Service Password Reset at https://dns-name/sspr as an administrator.
In the toolbar, click your name.
Click Configuration Editor.
Click Settings > Tokens.
Use the help to configure the settings for tokens.
In the toolbar, click Save changes.
This feature enables the users to verify an email token from a different browser session than the one from which they initiated the user activation process. Verifying email tokens across sessions ensures seamless transition from one session to another without losing progress or encountering authentication issues.
NOTE:This feature is only available for the User Activation module.
If users starts the user activation process but later switches to a different browser session (e.g., due to a browser crash or intentionally opening a new tab), they should be able to continue where they left off.
Additionally, you can force users to verify that whether they are humans or a robots using the Google reCAPTCHA after user activation email token verification in different browsers.
The following example scenarios describe how this feature works:
Scenario 1: Maria initiates Self Service Password Reset User Activation process in a Chrome browser on the system. However, Maria copies the email verification link provided in the email manually and pastes the email verification link into the Firefox browser session window. If the Allow Token Verification in a Different Browser Session feature is enabled, Maria can verify that email token in the Firefox browser.
Scenario 2: Paul starts the Self Service Password Reset User Activation process on his home laptop but realizes he needs to leave. Later, he continues the process on his tablet to verify the email token. If the Allow Token Verification in a Different Browser Session feature is enabled, he can verify that email token through his tablet.
By default, Self Service Password Reset does not allow users to verify their email token in a different browser than the one from which they initiated the user activation process. To use a different browser for the user activation email token verification, perform the following steps:
Login to Self Service Password Reset at https://dns-name/sspr as an administrator.
In the toolbar, click your name.
Click Configuration Editor.
Click Settings > Tokens.
Enable the Allow Token Verification outside the Browser Session option.
Enable the Verify ReCaptcha Post Token Verification option, if you want to force users to verify that they are humans or robots. If this option is enabled, it stops the bots from completing the user Activation process.
NOTE:This option is applicable if the Allow Token Verification in a different Browser Session option is enabled.
Navigate to Settings > Captcha.
Select the User Activation page in the CAPTCHA Protected Pages to protect user activation page using CAPTCHA after token verification in another browser.
NOTE:
If the Verify ReCaptcha Post Token Verification option is not enabled and the User Activation page is selected in the CAPTCHA Protected pages option, then email token verification in a different browser will be unsuccessful.
Ensure to configure reCAPTCHA Site Key and reCAPTCHA Secret.
Select the required reCAPTCHA Mode from the list.
In the toolbar, click Save changes.