A map of the world with an overlay of binary code and computer chips. In the center of the image is a digital key.

Introduction

End users forgetting their password continue to be a pain point for many IT organizations. Many of them have their Help Desk teams answering thousands of calls per month just for password resets. This is typically a huge chunk of the total calls received by the help desk each month. It takes the help desk analyst several minutes to authenticate the user on the other end of the line before the user’s password can be reset and go back to work. This is clearly a lose-lose situation with the loss of productive time for the end user and prevents the help desk analyst from answering more critical service calls.

Solution

In order to reduce or completely remove the burden of password resets from the Help Desk, organizations need to empower their end users by allowing them to perform self-serviced password resets. In a self service password reset solution, the end user will not need to call the help desk. Instead, the system will be able to authenticate and verify the identity of the end user through a set of challenge questions that the user sets up during registration.

Enabling Forgotten Password Authentication

Before users can perform self serviced password resets in IBM Security Identity Manager (ISIM), the ISIM Administrator will first need to enable forgotten password authentication. The administrator can configure the login behavior whenever a user successfully authenticates through forgotten password. For example, they can choose to allow the user to immediately reset their password and login to the system, have ISIM reset the password and email it to the user, or have ISIM email a link to the user where they can reset their password.

Configuring Forgotten Password Settings in ISIM.

Configuring the Challenge Behavior

The ISIM Administrator will also need to configure the challenge behavior. They can choose to provide the list of challenge questions, or let the end users specify their own questions. The number of questions needed to be set up and number of questions required for successful authentication through forgotten password can be set as well. Finally, the administrators can specify rules around answers that can be allowed and accepted by the system – for example, answers cannot have the userid, or answers must be unique for each question.

Setting up Challenge Response Information in the SSUI or ISC

The SSUI (Self Service User Interface) is ISIM’s out of the box UI for the end user. This is a web application that user access with their web browser. It is where they will enter their challenge-response information. When a user logs in to the SSUI for the first time after the Admin has enabled Forgotten Password Authentication, the user will be prompted to set their Forgotten Password Information.

The ISC (Identity Service Center) is the new end-user UI that has a modern look and feel. If the Administrators has installed and enabled the ISC, then users can also set their Forgotten Password Information through the ISC.

The sample screenshot below is a user setting their forgotten password information in the SSUI.

Changing Forgotten Password Information in ISIM.

Self Service Password Reset Using the SSUI or ISC

Once users have set their forgotten password information in ISIM, they will be able to reset their own password in the SSUI or ISC by clicking the “Forgot your password” link in the login page. When they click the “Forgot your password” link, the system will attempt to authenticate the user through forgotten password information.

Using the Self-Service Password Reset feature in ISIM.

Then, depending on how the Administrators have set up forgotten password authentication, they will be able to change their password.

Self Service Password Reset Using the DPRA

In order to fully empower end users, the DPRA (Desktop Password Reset Assistant) can be deployed. DPRA allows end users to reset their passwords right on their desktop login screen. That means, if the user is sitting in front of their Windows desktop login screen and have forgotten their password, they can reset their password right there without the need to access the SSUI or ISC in a browser.

The short video below shows the end-user experience in Windows 7, 8.1 and 10 when resetting their password through DPRA.

Empowering End Users with Self-Service Password Resets

Services

Solutions

Pricing

Resources

Events

About Us

Get Started