An administrator can configure the password policy settings for eDirectory and provide a Self Service Password Reset proxy user the permission to read the password from eDirectory. During Single Sign-On process for the Forgotten Password module, this permission allows Self Service Password Reset to provide details on behalf of the user. Also, the user is not prompted to enter credentials or to set a temporary password on the user account.
Proxy users play a role in SSPR for scenarios where users face account lockout or are unable to reset their passwords. It adds an additional layer of security by ensuring that only authorized individuals can perform password resets on behalf of others. Users with generic proxy user rights perform operations such as pre-authentication.
Use the following steps for an integrated deployment of Self Service Password Reset or a standalone deployment to allow users to read password by using the Self Service Password Reset proxy user.
To provide a Self Service Password Reset proxy user permission to read the password from edirectory, perform the following steps:
Log in to Self Service Password Reset at https://dns-name/sspr as an administrator.
In the toolbar, click your name.
Click Configuration Editor.
Click Settings > LDAP > LDAP Settings > NetIQ eDirectory > eDirectory Settings.
Ensure to enable the Read User Passwords.
Click Save changes in the toolbar.
To configure the password policy settings for edirectory, perform the following steps:
Log in to iManager.
Select Roles and Tasks from the header icons.
Select Passwords > Password Policies.
Select the appropriate password policy.
Click the Password tab, and then click Configuration Options tab.
Enable the Allow the following to retrieve passwords check box.
Click Insert and select the Self Service Password Reset proxy user.
Click OK.