Passwordless and password reset

Question

Hello

We are evaluating Adaxes for our consulting company and for our customers as well.

Our company is fully password less today. Our production setup works with FIDO2+PIN or SSO provided by our IDP (Workspace ONE) and we federated Adaxes Trial with it with no issues.

One of the edge case we would like to support is the ability for some password less users to reset their's AD password.

This would be used when our consulting team deploy on our production setup some new services that we want to test without paying the SSO tax that some services include.

We would like to have a password reset option available from the self service portal but post authentication.

Here is the intended scenario:

• the user access the self service portal and get redirect to IDP
• IDP authenticate the user using FIDO2+PIN or SSO and redirect them to self service portal
• the portal display the user profile and an option to reset an unknown password using e-mail confirmation is visible

Is it something we can achieve with Adaxes?

Thanks a lot

Comments

Hello,

the user access the self service portal and get redirect to IDP IDP authenticate the user using FIDO2+PIN or SSO and redirect them to self service portal

It is possible to configure Adaxes Web interface to be accessed via SAML-based SSO. For details, have a look at the following tutorial: https://www.adaxes.com/tutorials_WebInterfaceCustomization_EnableSamlBasedSingleSignOn.htm.

the portal display the user profile

It is possible to display user profile and an option to change/reset user password in the Web interface. For information on how to configure Adaxes Web interface to display the My Account page after sign in, have a look at the following help article: https://www.adaxes.com/help/DisplayMyAccountAfterSignIn.

an option to reset an unknown password using e-mail confirmation is visible

What exactly do you mean? Please, provide all the possible details regrading the desired behavior with live examples.

---

Hello

Yes, as said we federated Adaxes Trial without any issues. SSO is working fine.

The question is about accessing the password reset option post-login.

That's the specificity of password less situation here.

Usually you've :

• password reset pre-login
• password change post-login

But since we are password less (or more accurately, password blind), we cannot change the password because we don't know the current one.

So the question is: is it possible to use the password reset option but once logged.

Thanks a lot

---

Hello,

Thank you for the clarification. Could you, please, also clarify what role the "e-mail confirmation" should play in the workflow? A live example would be appreciated.

To allow users reset their passwords right after login:

1. Configure the Web interface to display the My Account page after login: https://www.adaxes.com/help/DisplayMyAccountAfterSignIn.
2. Enable the Change password operation and disable the Reset password one for the Web interface. For information on how to enable/disable operations in Web interface, please, have a look at the following tutorial: https://www.adaxes.com/tutorials_WebInterfaceCustomization_DisallowCertainOperationsOnADObjects.htm.
3. Grant users the permissions to reset their own passwords. For information on how to grant the permissions, please, have a look at the following tutorial: https://www.adaxes.com/tutorials_DelegatingPermissions_GrantRightsToResetPasswords.htm.
4. Finally, after login users should see something like the following:

---

That's pretty impressive. I got it working in no time following your instructions.

Regarding the e-mail conformation, forget about it. The idea was to confirm the password reset operation with a OTP code sent by e-mail but that's icing on the cake.

Thanks a lot for your help

---

Hello,

That's pretty impressive. I got it working in no time following your instructions.

Thank you for the confirmation, it is much appreciated.

The idea was to confirm the password reset operation with a OTP code sent by e-mail but that's icing on the cake.

This option is available only for self-password reset. The authentication settings of the password self-service policy effective for the users should be like the following: