External Page Password Reset, separate then LCM registration

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Which IIQ version are you inquiring about?

Version 8.3

Share all details related to your problem, including any error messages you may have received.

Hi team,

We want to create a separate form in IIQ which is to reset password for unauthenticated users, we cannot use the LCM registration workflow form as we are using this for internal as well external users, hence we would like to implement a second Password reset form(External) which will be accessible only to internal users(unauthenticated).
We have tried it to implement via Plugin and QuickLink but not sure how to make those particular URL unprotected as both plugin and Quicklink URL works once user is logged into SailPoint.

Could you please let us know how can we make a URL as external URL to be accessible by unautheticated users wherein we can call plugin or workflow via Quicklink

2

Hi @gargshub5,

if ou something out of SP environment, is better if you create a standalone external webpage that call a WF for reset pwd.

With unauthenticated users, you mean the users that cannot access to SP?

3

HI
By unauthenticated I mean the users who are not able to do SSO to sailPoint since there password is expired and need to reset it. So need a Password Reset form before they can login.

Could you tell me how to create a standalone form and to make it visible externally?

4

I do have the workflow ready, but not sure from where to call since in QuickLink we can give either action=“External” or action=“Workflow” is there a possibility we can provide both?

5

Ok, I understand. In this case you have an other ways.
Usually, an AD user, with expired pwd and not locked, can change own pwd at first login on windows or in outlook web for example. In this case, the user update the pwd and you can use PasswordInterceptor:

https://community.sailpoint.com/t5/Shared-Documents/Password-Interceptor-for-Microsoft-Active-Directory-Version-24-0/ta-p/248166

You can install PWI in IQService server and it detect the pwd changes and send it to SP.

Also, read the last page of this document about Windows Desktop Password Reset Utility, maybe can help you:

If you can use those and you need deploy a webpage, I want to advise, that is OOTB solution not implemented in SP.
But, you can deploy a simple page that call IIQ api for launch a workflow. There you can find all api:
https://community.sailpoint.com/t5/Technical-White-Papers/IdentityIQ-REST-API-Integration/ta-p/76814

Obviosully, in this page you configure the access with a service account and launch the WF for a the specific user. Its not a simple and rapid solution.

I suggest to use the SP solution like Password interceptor.

PS Usually, for expire and locked user, the reactivation is made by the Service Desk or third part(Manager, technician…) for a security question too. So, could be util the pwd expiration reminder
https://community.sailpoint.com/t5/Services-Standard-Deployment/SSD-Password-Expiration-Reminder/ta-p/80531?attachment-id=418