1 Overview
SoftwareCentral offers a simple way for end users to reset their password, if they should forget it.
Most users today have configured their smartphones or tables to send and receive mails from their company account.
By taking advantage of this we have created a simple way for users to reset their password with only their smart device.
2 Requirements
Users must have their mail address assigned to them in the Active Directory.
3 Security
Users can only reset password for their own accounts, where they have access to the, in the AD associated, mailbox.
The link the user receives contains a temporary key which is impossible to decode.
If a harmful entity should gain access to the database, all data is encrypted using an AES algorithm.
4 How does it work?
- The user sends a mail from his smart device to a “reset-password” mail address.
- The user receives a link in his inbox on the smart device that can be used to reset the password.
- The user clicks on the link and can then from his smart device enter a new password for his account.
The mail the user receives is a reply to the mail the user sent, with the subject starting with RE:. On the page the link opens, the user types the user name and the new password twice and clicks Reset Password. The link can only be used once, and it stops working after the number of hours that has been set for the link expiration.
A reset request is only answered if the mail address of the sender is registered on a user in the Active Directory. Each request mail is deleted from the mailbox after it has been processed.
5 Setting it up
The administrator sets up a mailbox that SoftwareCentral monitors, and a web site where the users reset their password.
| Setting | What to enter |
|---|---|
| Mail protocol, server, port | IMAP or POP3, the mail server and its port. The mail server must use SSL. |
| Mail user name and password | The account of the mailbox. The mailbox must be empty before you configure SoftwareCentral to use it. |
| Polling interval | How often, in seconds, SoftwareCentral looks for new mails. The shorter the interval, the faster the answer the users get. |
| Anonymous site address | The address of a SoftwareCentral site with anonymous authentication, where the link in the mail points to. It should use HTTPS. |
| Link expiration time | How many hours the link works. |
| Image path and header text | Your own logo and name on the reset page. |
The steps are described in Reset Password Configuration. The settings only apply after the SoftwareCentral service has been restarted.
6 Messages the user can get
| You see | What to do |
|---|---|
| Key is missing. Make sure that you copied the entire link. | Open the link in the mail again, in full. |
| The key has already been used. Please request a new password reset. | Send a new mail to the reset address. |
| The key has expired. Please request a new password reset. | Send a new mail to the reset address, and use the link sooner. |
| Invalid username. / You must enter your username. | Type your own user name. |
| The entered passwords does not match. | Type the same password in both boxes. |
| Password must be at least ... characters long. | Choose a longer password. |
| Your password has been changed with success. | Sign in with the new password. |
| Something went wrong. Contact your helpdesk if the error persists. | Contact the service desk. |
7 Best practice
- Use HTTPS on the anonymous site, so the new password is not sent over the network in clear text.
- Use a mailbox that is only used for resets, and empty it before you connect SoftwareCentral to it, because every mail in it is treated as a request.
- Keep the link expiration time short.
- Check that the users have their mail address on their account in Active Directory, and tell them which address to write to.
- Test the connection to the mailbox after you have changed the settings, and restart the SoftwareCentral service.