0 votes

Hello

We are evaluating Adaxes for our consulting company and for our customers as well.

Our company is fully password less today. Our production setup works with FIDO2+PIN or SSO provided by our IDP (Workspace ONE) and we federated Adaxes Trial with it with no issues.

One of the edge case we would like to support is the ability for some password less users to reset their's AD password.

This would be used when our consulting team deploy on our production setup some new services that we want to test without paying the SSO tax that some services include.

We would like to have a password reset option available from the self service portal but post authentication.

Here is the intended scenario:

  • the user access the self service portal and get redirect to IDP
  • IDP authenticate the user using FIDO2+PIN or SSO and redirect them to self service portal
  • the portal display the user profile and an option to reset an unknown password using e-mail confirmation is visible

Is it something we can achieve with Adaxes?

Thanks a lot

by (240 points)
0

Hello,

the user access the self service portal and get redirect to IDP IDP authenticate the user using FIDO2+PIN or SSO and redirect them to self service portal

It is possible to configure Adaxes Web interface to be accessed via SAML-based SSO. For details, have a look at the following tutorial: https://www.adaxes.com/tutorials_WebInterfaceCustomization_EnableSamlBasedSingleSignOn.htm.

the portal display the user profile

It is possible to display user profile and an option to change/reset user password in the Web interface. For information on how to configure Adaxes Web interface to display the My Account page after sign in, have a look at the following help article: https://www.adaxes.com/help/DisplayMyAccountAfterSignIn.

an option to reset an unknown password using e-mail confirmation is visible

What exactly do you mean? Please, provide all the possible details regrading the desired behavior with live examples.

0

Hello

Yes, as said we federated Adaxes Trial without any issues. SSO is working fine.

The question is about accessing the password reset option post-login.

That's the specificity of password less situation here.

Usually you've :

  • password reset pre-login
  • password change post-login

But since we are password less (or more accurately, password blind), we cannot change the password because we don't know the current one.

So the question is: is it possible to use the password reset option but once logged.

Thanks a lot

0

Hello,

Thank you for the clarification. Could you, please, also clarify what role the "e-mail confirmation" should play in the workflow? A live example would be appreciated.

To allow users reset their passwords right after login:

  1. Configure the Web interface to display the My Account page after login: https://www.adaxes.com/help/DisplayMyAccountAfterSignIn.
  2. Enable the Change password operation and disable the Reset password one for the Web interface. For information on how to enable/disable operations in Web interface, please, have a look at the following tutorial: https://www.adaxes.com/tutorials_WebInterfaceCustomization_DisallowCertainOperationsOnADObjects.htm.
  3. Grant users the permissions to reset their own passwords. For information on how to grant the permissions, please, have a look at the following tutorial: https://www.adaxes.com/tutorials_DelegatingPermissions_GrantRightsToResetPasswords.htm.
  4. Finally, after login users should see something like the following: image.png
0

That's pretty impressive. I got it working in no time following your instructions.

Regarding the e-mail conformation, forget about it. The idea was to confirm the password reset operation with a OTP code sent by e-mail but that's icing on the cake.

Thanks a lot for your help

0

Hello,

That's pretty impressive. I got it working in no time following your instructions.

Thank you for the confirmation, it is much appreciated.

The idea was to confirm the password reset operation with a OTP code sent by e-mail but that's icing on the cake.

This option is available only for self-password reset. The authentication settings of the password self-service policy effective for the users should be like the following: image.png

Please log in or register to answer this question.

Related questions

0 votes
1 answer

Hi, In a previous installation of Adaxes, we were able to reset users passwords, and send it automatically by SMS to the user. When we try to do the same in Adaxes 2018. ... when we reset a users password. A similar SMS works just fine when we create the user.

asked May 23, 2019 by eirikza (120 points)
0 votes
0 answers

Hello, I have a nice branded HTML email I'd like to use for the Self Service Invite and Self Service Password reset Emails. Is it possible to use HTML in the test fields under ... text so I'm guessing I can't but figured I'd ask rather than assume! Thanks!

asked Nov 19, 2015 by drew.tittle (810 points)
0 votes
1 answer

Hello Support, Are the self service questions and answers stored securely? Are they stored in the Adaxes database or in Active Directory? Thank you!

asked Nov 17, 2014 by strikk (360 points)
0 votes
1 answer

I am trying to customize the enrollment pop up page to specify the number format need, but I cannot for the life of me find the file or location where I can edit the html code needed to say this on the enrollment page, is this even possible?

asked Apr 10, 2023 by gwadmin (80 points)
0 votes
1 answer

When a user is blocked in Password Reset is there a way to manually unblock that user? Is there a report of blocked users?

asked Oct 10, 2022 by shawnsmith2881 (40 points)
3,326 questions
3,026 answers
7,727 comments
544,678 users