PingAM

Configure forgotten username retrieval

The forgotten username feature allows existing users to retrieve their usernames when they can’t remember them.

Common use cases

Retrieving a username discloses an identifier rather than changing a credential, so choose verification controls according to the risk of the accounts in your deployment:

  • Sign-on identifier recovery: Users who sign on with an opaque username rather than an email address can retrieve the username themselves instead of contacting a help desk. If users sign on with their email addresses, this feature adds little value.

  • Delivering the username securely: Enable Email Username to send the username to the address registered on the account. Use email delivery over Show Username, which returns the username to the client for display, where someone looking over the user’s shoulder or viewing a shared screen could see it.

  • Adding friction against enumeration: Enable Captcha on the publicly accessible endpoint to add friction against automated probing. When no unique account matches the request, AM continues without identifying a user and doesn’t send an email. Use consistent responses and additional abuse controls to reduce account-enumeration risk. Disclosing usernames aids targeted phishing and password-spraying attacks.

Configure AM for forgotten username retrieval

  1. In the AM admin UI, go to Realms > realm name > Services and select User Self-Service.

  2. Select the Forgotten Username tab.

  3. Enable Forgotten Username.

  4. Enable Captcha to turn on the Google reCAPTCHA plugin. Make sure you configured the plugin as described in Configure the Google reCAPTCHA plugin.

  5. Enable Security Questions to display security questions to the user during the forgotten password reset process. The user must have security questions defined in their profile, and must correctly answer the presented questions to be able to reset passwords.

  6. Enable Email Username for the user to receive the retrieved username by email.

  7. Enable Show Username for the user to see their retrieved username on the browser.

  8. In the Token LifeTime (seconds) field, enter an appropriate number of seconds for the token lifetime. If the token lifetime expires before the user resets their password, then the user will need to restart the forgotten password process over again.

    Default: 300 seconds.

  9. To customize the forgotten username outgoing email, perform the following steps:

    • In the Outgoing Email Subject field, enter the subject line of the email.

      The syntax is lang|subject-text, where lang is the ISO 639 language code, such as en for English, fr for French, and others. For example, the subject line value could be: en|Forgotten username email.

    • In the Outgoing Email Body field, enter the text of the email.

      The syntax is lang|email-text, where lang is the ISO 639 language code. Note that email body text must be all on one line and can contain any HTML tags within the body of the text.

      For example, the email body text could be: en|Thank you for your inquiry! Your username is %username%.

  10. Save your changes.