Domino SingleSignOn - Level 2 - Self Service Password Reset Application
Thomas Hampel
14 February 2017Based on a recent discussion with a customer it seems there still is not enough information on how to simplify authentication for Notes/Domino users.
This is the second post our of a series of blog posts describing how to move from password based to seamless authentication.
Once you have established LDAP Authentication you can approach the next stage:
Level 2 - Self Service Password Reset Application
Combined with a Self Service Password Request HTTP application (or this fancy one ) users can reset Notes password without the help of an administrator just by using a web browser.
Users must be authenticated in order to reset their own password, but due to the configuration done in level 1 they can use Active Directory credentials to log in.
Once authenitcated a user can just define a new password which is applied immediately in the IDVault. And just seconds later the password can be used to log into the Notes Client.
Pros and Cons
+ Lost/forgotten passwords on a monday morning are no longer your problem. Users can handle this problem alone.
+ You don't need to distribute NotesID passwords for newly created users.
- There still is a NotesID password to remember
- There still is a password prompt every time you start the Notes client and/or every time you open an encrypted mail in iNotes
- The Self Service Password Request HTTP application does not apply any feedback on password quality or strength.
Prerequisites:
- Notes ID Vault has been established and contains the NotesID’s of all users
- User must be authenticated, preferably using Active Directory authentication as described in the previous post level 1
- Custom Password Reset application template,
Please note the template provided by IBM as part of the Domino server is not officially supported and is provided as example only. See Technote 1330905
Configuration
Setup instructions have already been provided by IBM, so I'm not describing those steps again.
Once completed you should have a functioning PW reset application. However, I would like to highlight a few important details
- The agent and the form needs to be signed with an ID which has IDVault Password Reset authority
- The ACL of this database must have an Administration server defined, the Admin server specified there must be the one that hosts the IDVault.
For improved usability I do recommend a little tuning:
- Create a URL which users can remember, e.g. by creating a web redirect rule
http://yourserver.domain.com/passwordreset ==> /pwreset.nsf - Modify the form “fmPasswordReset” to display your corporate password rules, e.g.
“The new password must have a minimum of 8 characters. It must contain a mixture of lowercase alphabetic, uppercase alphabetic, numbers and special characters. Three of these four conditions must be met.” - Modify the source code to confirm the password change request has been submitted and to verify if password rules have been followed.
Without this modification users will not get any feedback if the new password has been applied or not.
so update the source code of the Form “Password Change” , Sub “OnSubmit” as follows:
var i = 0;
var k = 0;
var h = 0;
var have = [0, 0, 0, 0];
var characters = ["abcdefghijklmnopqrstuvwxyz", "ABCDEFGHIJKLMNOPQRSTUVWXYZ", "0123456789"];
var minLen = 8;
var minDif = 3;
var pw1 = document.forms[0].pw1.value;
var pw2 = document.forms[0].pw2.value;
for (i=0; i
h = 3;
for (k=0; k
if(characters[k].indexOf(pw1.substr(i,1)) >= 0)
{
h = k;
}
}
have[h] = 1;
}
if ( pw1.length < minLen )
{
alert("You must enter a password with at least " + minLen + " characters");
return false
}
else if( pw1 != pw2 )
{
alert("Entered password don't match");
return false
}
else if( have[0] + have[1] + have[2] + have[3] < minDif )
{
alert("Password must be more complex, use Numbers, Lower-, Upper-, Special-Characters");
return false
}
else
{
alert("Thank you, your request has been submitted. The new password can be used now.");
return true
}
var k = 0;
var h = 0;
var have = [0, 0, 0, 0];
var characters = ["abcdefghijklmnopqrstuvwxyz", "ABCDEFGHIJKLMNOPQRSTUVWXYZ", "0123456789"];
var minLen = 8;
var minDif = 3;
var pw1 = document.forms[0].pw1.value;
var pw2 = document.forms[0].pw2.value;
for (i=0; i
h = 3;
for (k=0; k
if(characters[k].indexOf(pw1.substr(i,1)) >= 0)
{
h = k;
}
}
have[h] = 1;
}
if ( pw1.length < minLen )
{
alert("You must enter a password with at least " + minLen + " characters");
return false
}
else if( pw1 != pw2 )
{
alert("Entered password don't match");
return false
}
else if( have[0] + have[1] + have[2] + have[3] < minDif )
{
alert("Password must be more complex, use Numbers, Lower-, Upper-, Special-Characters");
return false
}
else
{
alert("Thank you, your request has been submitted. The new password can be used now.");
return true
}
- In order to support clustered environments the source code of the agent “User Password Reset” needs to be updated as follows:
Set Doc = Session.DocumentContext
Call Session.ResetUserPassword( session.Currentdatabase.Acl .Administrationserver,"",Doc.GetItemValue("pw1")(0))
Call Session.ResetUserPassword( session.Currentdatabase.Acl .Administrationserver,"",Doc.GetItemValue("pw1")(0))
Conclusion
Self Service Password Reset application combined with LDAP authentication will eliminate the need to distribute Notes ID passwords to end users.
Administrators can register new NotesID's with completely random passwords that they do not need to remember nor need to distribute to end users.
Notes client setup instructions can be simplified so that end users have to define the password themselfes before they can start Notes for the first time.
References:
- Karl-Henry Martinsson - Free Software – Password Reset for Notes/Domino
- Domino 9.0 - Setting up the sample self-service application to allow ID vault users to reset their Notes passwords
- Domino 8.5 - Setting up the sample self-service application to allow ID vault users to reset their Notes passwords
- Technote 1330905 - Is the sample password reset application supported in a production environment?