Checking the Have I been Pwned DB

Question

We're a new customer coming from ManageEngine and looking to use the password self service portal of Adaxes, I searched the Q&A and Scripts but didn't see anything like this, but we're looking for a way to check the Have I Been Pwned DB/API when a user goes to reset their password. ManageEngine Self Service supports this and we do not want to lose this functionality.

Can Adaxes do this with any sort of script setup or functions?

Answer 1

Hello,

Unfortunately, we are not aware how the functionality works in ManageEngine, but there is nothing like that in Adaxes Password self-service built-in functionality. If you know how exactly you need the whole thing to work, please, get back to us with all the possible details and we will see if there is a solution we can suggest.

Comments

More or less, it uses API calls to check the NTLM hash of an AD account to known hashes in the Have I Been Pwned database.

There are two API versions which can be found here:

https://haveibeenpwned.com/API/v2

https://haveibeenpwned.com/API/v3

In ManageEngine, when the user submits the password change request, it kicks off an API call to the Have I been Pwned database, and the API returns a response code, if the response code is 200, this confirms a match, a 404 response code means there was no match and the password is safe to use.

---

Hello,

Thank you for the provided details. We passed them to the corresponding department for consideration.

As of now, you can use a business rule triggering Before self-resetting password and a PowerShell script. The script will make the corresponding API call and act according to the response. For example, the operation can be cancelled with the corresponding message. However, this will be done once the user passes all the verification steps and submits the request for password reset.