Web portal to change an AD password

[robjduk]

Can someone please give me their opinion on how you would achieve the following....

 

Scenario:

Users have an AD account but no network email access by design. Personal email address is in active directory.

 

Required:

 

-External facing web portal.

-User puts their username in a box.

-User is then either...

A: emailed a link to a page with a new password which preferably expires.

B: emailed a new password (less preferable as password would be in plain text).

 

If it helps, I have a SharePoint 2013 site active but must stress, I want nothing to do with the setup except paying a third party with experience of this to set this up. Can anyone point me to someone who can create such a system please?

Its sooooo frustrating because I know it can be done but no idea who to turn to. Talking to one third party about maybe setting something up but its nothing they have really done and am hesitant to put their name to it.

 

Thank you and really hope someone can help me on this. Cash is waiting to be spent!

[Nugget]

Hi There robjuk, I have recently been to work experience with these guys and they are brilliant excellent customer service. Is this the sort of thing you were looking for? https://www.tools4ever.co.uk/software/enterprise-single-sign-on-manager/

[robjduk]

Looks interesting. I will take a look this morning.

Thanks

[robjduk]

Looks good but seems the users would have to setup security questions which I doubt the users will bother with

 

The search continues.

[Nugget]

Looks good but seems the users would have to setup security questions which I doubt the users will bother with

 

The search continues.

 

Inside of the management console you can set which questions to ask and also set them default so they have to be answered. Also I have found some product manuals that might give you more info. Just scroll down to ssrpm.

 

https://www.tools4ever.co.uk/resources/manuals/

Edited February 11, 2015 by Nugget

[Edu-IT]

A lot of places seem to use this:

 

pwm - Open Source Password Self Service for LDAP directories - Google Project Hosting

[dhicks]

Users have an AD account but no network email access by design. Personal email address is in active directory.

 

We have exactly the same setup for parent accounts for our VLE - each parent is given an account to let them log in to the VLE and see things like their childrens reports. They aren't provided with a domain email address, but we store their email address in active directory. Parents can't sign up online, they provide their email address along with other details when they register their child, and that data is stored in our MIS. That way we can be sure that a given email address matches an actual parent.

 

I've just (almost) finished writing a password reset utility - a basic HTML form that the parent enters their email address into, that sends an AJAX request to a CGI script to request that the password for that email address be reset. Server-side, it checks which username that email address matches and generates a unique request ID, which is sent via email to the email address as a link for the parent to click on and complete the password reset process. The parent can choose whatever password they like. I'm just testing this now, in preparation for rolling out to parents.

[penfold]

A lot of places seem to use this:

 

pwm - Open Source Password Self Service for LDAP directories - Google Project Hosting

@Edu-IT - have you used this?

[Edu-IT]

No but it seems popular. Why?

[fiza]

Specops keep sending me details of their offering. Might be worth a look.

 

Specops Password Reset | Password Management | Specops Software

[penfold]

I'm just automating new account requests and was looking at how we currently deal with accounts. I thought that it might be better than what we currently do but after speaking to someone there is a reason (political) why we haven't gone down this route already.