Password Reset Security Questions

Question

We currently use a paper form for security questions which helps us to reset passwords of remote users. However the paper list has become large so we are looking for a way to sort of re-enroll users with new security questions. We want to force users to supply the security questions and have a way to monitor who has enrolled.

However we dont want users to reset their passwords per say. We want to collect the secret questions and have a copy of all of them that we could put into a sql database or encrypt and add them to the HR database.

Seeing as with Adaxes password self service reset we can see who has enrolled I was wondering if we could use this but just disallow the right to actually change the password.

On the surface however I cant see a way to actually find the secret questions that users have submitted.

Is this possible with Adaxes?

Answer 1

Hello,

Security questions of users are stored in plain-text form, so you can get them any time. However, security answers are not stored. Adaxes stores and compares only hashes of the answers. The only time when you can get an answer in plain text form is when a user enrolls for Password Self-Service, before they are saved by Adaxes. So, do you want to store answers in addition to questions? Could you describe the way how you want to use Adaxes in more detail? Can you describe how you view the process overall from the user perspective?

As for disabling the option to perform self-password reset, yes, that's possible. You can disallow users to reset passwords for themselves so that they can enroll only.