Chapter 7. Self-service Password Reset

By now, we have a functional FIM 2010 R2 able to manage our users and groups, and maybe also some self service. It is now time to look at one of the features of FIM that many customers believe is the most cost saving one.

The feature is Self-service Password Reset (SSPR), which will allow users to reset their own passwords if they have forgotten them, so they will not have to contact a help desk. Through that, we not only save ourselves a help desk call, but also allow the user to be productive again, quicker. This saves money!

In this chapter we will cover:

• Enabling password management in AD

• Allowing FIM Service to set passwords

• Configuring FIM Service

• The user experience

Anonymous request

What we need to keep in mind when looking at this feature is that the user, as he has forgotten his password, is unable to authenticate properly to FIM. So, the key problem with SSPR is how to authenticate the user.

Let's take an example.

Kent, our contractor, has forgotten his password. He then makes a request anonymously to FIM to reset the password of the user account Kent. Well, FIM won't just do that! So, we tell FIM to try to figure out who the requestor is. We add an Authentication (AuthN) workflow, which gives Kent a chance to prove his identity. If the AuthN workflow proves to FIM that the requestor is indeed the user Kent, it will allow Kent to reset his password.

In FIM 2010 R2, there are two built-in ways for FIM to find out who the user is—we can use either a Question and Answer (QA) gate or a One Time Password (OTP) gate.

QA versus OTP

There are two different ways of doing SSPR in the R2 release—QA (Question and Answer) and OTP (One Time Password).

QA basically...

Enabling password management in AD

The goal for SSPR is, usually, to reset the password of users' account in Active Directory, but the SSPR feature in FIM is not limited to that. It can be used to reset passwords in other CDSs as well.

In order for FIM to change the password of a user in AD (or any other CDS), the account used by FIM needs to have the Reset password permission in AD, or a similar permission in another CDS:

In Management Agents for the target CDS, in this case the AD, we need to check the Enable password management checkbox:

If we then look at the settings, we can make some adjustments, as shown in the following screenshot:

Note

The Unlock locked accounts when resetting passwords option is not enabled by default, but I would think that most implementations of SSPR will use that setting. It might be that the user actually locked his own account before realizing he forgot his password.

The Management Agent for AD is now ready for SSPR.

Allowing FIM Service to set passwords

The FIM Service account will be the account that calls FIM Synchronization Service, and tells it to reset the password in AD. But in order for the FIM Service account to be able to do that, we need to assign it some permissions with the following steps:

1. We need to add the account to a couple of groups created during installation (see Chapter 3, Installation) of FIM Synchronization Service.

2. Add the FIM Service account to the FIMSyncBrowse group:

   

   By default, this is a local group on the FIM Synchronization server; but you might have chosen to use groups in Active Directory instead. This will give FIM Service the ability to read information in FIM Synchronization Service.

3. To actually be allowed to initiate a password reset, we also need to add the FIM Service account to FIMSyncPasswordSet:

   

The call from FIM Service to FIM Synchronization Service to do a password reset is made using Windows Management Instrumentation (WMI). This in turn means we need to give...

Configuring FIM Service

SSPR is not enabled by default in FIM Service, so we need to enable some MPRs and configure some sets and workflows.

Security context

I am not sure if you remember the steps when we installed the FIM password registration and reset portals back in Chapter 3. But let me remind you of one critical part in that setup:

During the setup, we decided that the portal should be used for Intranet users. While configuring SSPR, we can configure some settings to only apply to Extranet users. At The Company, we only have one set of password registration and reset portals. But the idea is that you might also want to have a special set for Extranet users. Later, we will refer to this as security context. Security context can either be All or Extranet, where All means it applies to both Intranet and Extranet users.

Password Reset Users Set

The default MPRs around SSPR use a predefined set called Password Reset Users Set . If you look at the criterion for that set, you will find it...

The user experience

So what does this look like for the user? In my little example, the employees are the ones that will be using the SSPR to begin with.

In order to get the best user experience, requirement number one is that the client computer has the FIM client add-ins and extensions installed, as we talked about in Chapter 6, Group Management.

As soon as we enable the MPRs and John (a member of the Password Reset Users set) logs on to his computer, which has the FIM add-ins and extensions installed, it will start up a browser window connecting to the Password Registration portal, which we defined during the installation of the add-ins in Chapter 6.

He could also access the Password Registration portal manually; the experience is similar, but using the add-ins and extensions will likely increase the number of users actually taking time to register, as they will be automatically prompted to do so.

If we used FQDN for the Password Registration portal URL, we should make sure that the URL...

Summary

The SSPR feature is a very nice one, which can save companies that are using passwords a lot of money. In this chapter, we have seen how easy it is to enable and configure the Self-Service Password Reset feature. If you look at http://aka.ms/FIMR2QuickStart, you will see that there is a QuickStart tool to get started with SSPR even quicker.

We need to decide early on whether we want the same solution for both internal and external access to the SSPR feature. If we would like to separate them, we need to install a separate set of SSPR registration and reset portals and modify the FIM Service MPRs and workflows, accordingly.

Talking about external, what if the identities we manage are in the cloud? The next chapter will discuss how FIM can be used when managing cloud identities.