Skip to main content

Reset a password

By default, if users forget the password they use to access IDaaS or an application, they must contact an account administrator to reset it.

You can enable password reset so users can reset their password without contacting an administrator. When enabled, a Forgot your password? link appears on the sign-in page. When users click this link, they are prompted for their username and second-factor credentials. If both are valid, they are prompted to create a new password.

Password reset is supported when logging in to the following:

  • IDaaS
  • OIDC and OAuth applications
  • SAML applications
  • Active Directory
note
  • Password reset cannot be performed when logging in to RADIUS or Entrust Identity Enterprise applications.
  • Password reset is not available in the Entrust Identity app if the Soft Token PIN policy in IDaaS is set to false (disabled). See the setting, PIN Required in Modify Entrust Soft Token (ST) authenticator settings.

Prerequisites​

Configure the following settings of your IDaaS account to enable password reset:

  • Enable password reset. See Enable password reset.
  • Set Authentication Decisions. Set first-factor to password in the Resource Rule Authentication Decision settings (see Create and manage resource rules).
  • Assign password reset groups to users. If you have configured the Password Reset Settings of your account to require users to be part of specific groups, assign those groups to users accordingly (see Add users to IDaaS).
  • Assign required second-factor authenticators to users. If you configured an additional second factor for password reset, users must have at least one authenticator from Second-factor Authenticators Allowed to perform a Password Reset before they can reset their password (see Manage and assign user authenticators).

Active Directory password reset​

You can customize your account settings to let users reset their Active Directory password. This is useful when users need to complete password authentication but have forgotten their Active Directory password. For setup steps, see Enable password reset.

Requirements​

Active Directory password reset only works under the following conditions:

  • Your account is configured with a 4.0 IDaaS gateway or higher.
  • You are using Active Directory DS or Active Directory LDS with native users.
  • The IDaaS directory configuration that syncs Active Directory users to your IDaaS account is configured with SSL and with an Active Directory administrator that can reset password (the administrator is allowed to modify the following attributes:
    • unicodePwd
    • lockoutTimeout
    • pwdLastSet

Limitations​

The Minimum Lifetime (Minimum password age in Active Directory) is not enforced during a password reset.

A password reset URL is available at /#/reset/<userID> where userID is optional. 

For example, if the User ID is aliceg, then the password reset link would be mycorp.<region>.trustedauth.com/#/reset/aliceg

  • If set, userID lets users skip entering their username and go directly to the password reset flow.
  • If users open the reset URL while already signed in, they are signed out and redirected to the password reset flow.
  • If an invalid user ID is provided, an error message appears and users are prompted to enter their username.
  • If users click Cancel during the password reset flow, they are redirected to /#/reset.
  • If users cannot reset their password during the flow, they are redirected to the sign-in page.