Skip to content

Self Service Password Reset

Info

New in Atfinity 17.

A user who cannot log in asks for a reset link from the login screen, instead of asking an administrator for a new password. Atfinity emails them a link, and the link lets them choose a new password once.

It is a deployment-wide setting, not a per-tenant one, and it needs email sending configured for the tenant, since the link only reaches the user by email. A new Kubernetes deployment offers it, because the chart turns it on by default. Anything else keeps it switched off until you turn it on: set selfServicePasswordReset under api in the deployment's values file, or the SELF_SERVICE_PASSWORD_RESET_ENABLED environment variable when you run without the chart.

What the user gets

The reset link is valid for 30 minutes and works once. Asking for a second link invalidates the first one, and so does completing a reset.

The new password has to satisfy the same password rules as any other password, including the history of passwords the user has already used. A user who was locked out by too many failed login attempts can log in again after a completed reset. A user you deactivated stays deactivated, and a reset link is never sent to them.

The confirmation after asking for a link is the same whether or not an account exists for that address, so an address that receives no email is either unknown or not allowed to reset. Each address can ask five times per hour, and each network address twenty times per hour.

When it is not available

The login screen does not offer the link, and no email is sent, when the password is not Atfinity's to change. A server that offers Single Sign On still offers the reset to the users who sign in with a password, since the exclusions below are per user:

  • The deployment switched it off
  • An LDAP User Backend is configured for the tenant
  • The user was copied from LDAP, or may only log in through single sign on
  • The user has no password of their own to reset, which is the case for an account that only ever signed in through Single Sign On

It is also not available to a user who has to use a second factor but has not set one up yet. Whoever completes a reset for such a user would get to register the second factor as well, so those users ask an administrator for a new password instead.