In the IdP Adapters window, create or modify an instance of the HTML Form Adapter to enable a customized self-service password management capability.
PingFederate offers self-service username password management for users to change their network password. This optional capability is integrated into the HTML Form Adapter and the LDAP Username password credential validator (PCV). You can configure PingFederate to generate notification messages when users successfully change the password associated with their accounts through the HTML Form Adapter or when their passwords are about to expire.
If you are validating credentials through the PingOne for Enterprise Directory PCV, you can also enable the change password capability. Notifications for change password and password expiry are not supported at this point.
For self-service password management to work correctly with PingDirectory, you must grant the service account the
password-reset privilege. In PingDirectory use the
ldapmodify command to
apply the following change:
dn: uid=pfadmin,ou=People,dc=example,dc=com changetype: modify add: ds-privilege-name ds-privilege-name: password-reset
- In the PingFederate administrative console, go to .
To create a new HTML Form Adapter instance, click Create New
Instance or, to reuse one, select an existing HTML Form Adapter
If you are reusing an existing HTML Form Adapter instance, skip to step 1c to configure your adapter instance to enable self-service password management.
- On the Type tab, configure your adapter instance settings. Click Next.
On the IdP Adapter tab:
- In the Password Credential Validator Instance section, select the PCV instance as the credential validator.
- Optional: Update any default values or options.
Select the Allow Password Changes check box.
Configure your adapter instance options. For more information, see the
Change Password Notification
Select if you want PingFederate to generate a notification message for the user who has successfully changed their password through the HTML Form Adapter.Note:
The message is sent to the user's email address, specifically the mail attribute value returned by the LDAP Username PCV instance.
Show Password Expiring Warning
Select if you want the Sign On window to warn the user about an approaching password expiration.
Change Password Notification
Select to choose a notification publisher instance.Note:
If you have not yet configured the desired notification publisher instance, click Manage Notification Publishers.
Show Advanced Fields
Click to review or modify default values related to the change password capability. For example, update the Change Password Template field if you want to use a custom template to render the Change Password window.
- Optional: Customize and localize the on-window messages and notification messages.
You have created a new instance or modified an existing instance of the HTML Form Adapter with the self-service password management capability.
When a user signs on through this adapter instance, the user has the option to change the password associated with the account using the Change Password link.
You can also provide your users the per-adapter Change Password endpoint /ext/pwdchange/Identify, which allows them to change their password through this HTML Form Adapter instance without submitting single sign-on (SSO) requests.