Skip to main content

Enable password reset

Complete this procedure to enable users to reset their password during authentication.

Configure password reset​

  1. Click > Policies > Authenticators. The Authenticators page appears.

  2. Select Password Reset. The Password Reset settings appear.

  3. Select the Named Password you want to configure for password reset.

  4. Select Enable Forgot Password to enable users to reset their password during authentication.

    note

    You must also modify your IDaaS resource rules to enable password reset. See Manage password reset for more information.

  5. From Second Factor Authenticators Allowed to perform a Password Reset, select the second-factor authentication methods to allow. Keep the following behavior in mind:

    1. Drag and drop the selected methods in order of preference.
    2. During password reset, users are prompted to complete the method at the top of the list first.
    3. If a user does not have that method, they are prompted to use the next method in the list.
    4. If a user does not have any listed methods, they cannot reset their password.
    note

    Selecting Temporary Access Code as an allowed authenticator only lets users complete a Temporary Access Code challenge to reset a password. A Temporary Access Code cannot be used to satisfy a required Grid Card, OTP, or Token challenge before password reset.

  6. Optional: Select Additional second-factor.

    Users must complete second-factor authentication before they can reset their password. If you enable Should we ask for an additional second-factor when resetting a password?, users must complete two second-factor authentication challenges from the allowed second-factor list.

    warning

    Password Reset requires only one second-factor authenticator by default. Entrust recommends enabling this option so users must complete two second-factor authenticators when resetting a password.

    This password reset second-factor policy does not apply to the Entrust Identity app. For details, see the Entrust Identity app documentation.

  7. Select Unlock User Account to unlock the user's account and prompt the user to optionally reset their password.

  8. Select Send user account lock/unlock email notification to send an email to users when there is a password lock, unlock, or unlock attempt on their account.

  9. Select Allow Email OTP delivery to allow OTP delivery to a user's email address. If this option is cleared, the user receives the OTP by SMS or voice.

  10. Select Do not use IP Address for Resource Rule Risk Factors if you want to use IP address information for audit records, but not for resource rule risk conditions.

    note

    This setting appears only if you select One Time Password as a second-factor allowed for password reset.

  11. Click Save.

Repeat these steps, as required, for other Named Passwords.

Validate your changes​

After you save, verify the following:

  1. Users can access the forgot-password flow during authentication.
  2. Allowed second-factor methods are offered in the configured order.
  3. If additional second-factor is enabled, two second-factor challenges are required.
  4. Notification and OTP delivery behavior matches the options you selected.