PingFederate Server

Configuring self-service password management

In the IdP Adapters window, create or modify an instance of the HTML Form Adapter to enable a customized self-service password management capability.

About this task

PingFederate offers self-service username password management for users to change their network password. This optional capability is integrated into the HTML Form Adapter and the Lightweight Directory Access Protocol (LDAP) Username password credential validator (PCV). You can configure PingFederate to generate notification messages when users successfully change the password associated with their accounts through the HTML Form Adapter or when their passwords are about to expire.

If you are validating credentials through the PingOne for Enterprise Directory PCV, you can also enable the change password capability. Notifications for change password and password expiry are not supported at this point.

For self-service password management to work correctly with PingDirectory, you must grant the service account the password-reset privilege. In PingDirectory use the ldapmodify command to apply the following change:

dn: uid=pfadmin,ou=People,dc=example,dc=com
changetype: modify
add: ds-privilege-name
ds-privilege-name: password-reset

Steps

  1. In the PingFederate administrative console, go to Authentication → Integration → IdP Adapters.

  2. To create a new HTML Form Adapter instance, click Create New Instance or, to reuse one, select an existing HTML Form Adapter instance.

    If you are reusing an existing HTML Form Adapter instance, skip to [pf_substep_enableUsernameRecovery] to configure your adapter instance to enable self-service password management.

  3. On the Type tab, configure your adapter instance settings. Click Next.

  4. On the IdP Adapter tab:

    1. In the Password Credential Validator Instance section, select the PCV instance as the credential validator.

    2. Optional: Update any default values or options.

    3. Select the Allow Password Changes check box.

      Screen capture of the IdP Adapter tab and adapter instance configuration for self-service password management. The Allow Password Changes check box is selected.

    4. Configure your adapter instance options. For more information, see the following table.

      Option Effects

      Change Password Notification

      Select if you want PingFederate to generate a notification message for the user who has successfully changed their password through the HTML Form Adapter.

      The message is sent to the user’s email address, specifically the mail attribute value returned by the LDAP Username PCV instance.

      Show Password Expiring Warning

      Select if you want the Sign On window to warn the user about an approaching password expiration.

      Change Password Notification

      Select to choose a notification publisher instance.

      If you have not yet configured the desired notification publisher instance, click Manage Notification Publishers.

      Show Advanced Fields

      Click to review or modify default values related to the change password capability. For example, update the Change Password Template field if you want to use a custom template to render the Change Password window.

  5. Optional: Customize and localize the on-window messages and notification messages.

Result

You have created a new instance or modified an existing instance of the HTML Form Adapter with the self-service password management capability.

When a user signs on through this adapter instance, the user has the option to change the password associated with the account using the Change Password link.

You can also provide your users the per-adapter Change Password endpoint /ext/pwdchange/Identify, which allows them to change their password through this HTML Form Adapter instance without submitting single sign-on (SSO) requests.