Reset IdentityIQ User Password with API

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Which IIQ version are you inquiring about?

8.5

Hi Sailors,

Would like to know whether there is any way to reset an IdentityIQ user’s password using API calls?

2

@Bernardc Yes. We achieved it using custom REST APIs, so it is doable. are you looking for OOTB solution? You can launch a workflow and in the workflow generate a new password and reset on the user.

3

Hi @neel193 ,

I am testing the SCIM REST API,

Using:
PUT request
http://10.201.200.6:8080/identityiq/scim/v2/Users/0ac9c8069f8314e9819f842ae45d2bc4

With body:

{
  "password": "<NEW_PASSWORD>"
}

But it response require userName:

{
    "scimType": "invalidValue",
    "detail": "Attribute 'userName' is required",
    "status": "400",
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:Error"
    ]
}

But if I include userName:

{
    "scimType": "mutability",
    "detail": "Attribute 'userName' can't be changed.",
    "status": "400",
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:Error"
    ]
}
4

Hi @Bernardc ,

Make sure you are populating the identity attribute value of the identity as ‘userName’. The identity attribute value is stored as “name” in Identity object, you can view the identity from debug page.

5

Yes, you can absolutely achieve this via API calls. The best practice approach is to implement a custom REST API endpoint in IdentityIQ.

We successfully use this exact method in our environment. Our custom REST API exposes password reset capabilities to external help desk applications and self-service chatbots. To keep it secure, the API requires the user to successfully pass IdentityIQ’s native Authentication Questions (Challenge Q&A) before the reset payload is executed.

You can build a custom REST resource in IIQ using a custom Java class that extends sailpoint.rest.BaseResource to wrap your password reset logic.

6 
curl --location --request PUT '{Base_URL}/scim/v2/Users/<identity_id>' \
--header 'Content-Type: application/scim+json' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer ********' \
--data-raw '{
    "userName": "<username>",
    "password": "<sometext as per the passwordpolicy>"
}'

This is how you can use to reset the password for an user using RestAPI.

7

Hi @Bernardc

If you’re using the SCIM API, make sure the “userName” matches the Identity’s name attribute in IdentityIQ and that the password satisfies the configured password policy.

curl --location --request PUT 'http://<host>:<port>/identityiq/scim/v2/Users/<userId>' \

--header 'Content-Type: application/scim+json' \

--header 'Accept: application/json' \

--header 'Authorization: Bearer <token>' \

--data-raw '{

  "userName": "user",

  "password": "NewP@ssw0rd123"

}'

If SCIM doesn’t meet your requirements, another approach is to expose a custom REST endpoint that launches a workflow to reset the password:

WorkflowLauncher launcher = new WorkflowLauncher(context);

launcher.launch("Reset Password Workflow", workflowArgs);

This approach gives you more control over validation, password generation, approvals, auditing, and notification logic.