Self-service Password Reset - what are you using?

[gshaw]

We'd like to implement some form of self-service site for users resetting network passwords remotely. Tried a few options so far but no joy:

 

• Office 365 built-in features - won't work as we use Azure AD Sync and thus require Password writeback functionality, which brings us onto...
  
• Azure AD Premium - ridiculous per-user pricing, shame on you Microsoft
  
• Centrify - currently on a free plan and unsure how long features will be supported
  
• iamcloud - were on this but dropped the subscription now Microsoft will include proper OneDrive functionality in next version of Windows 10 (their CDM tool was a big feature for us initially)
  

Seen a couple of 3rd party AD-based products we could publish via Azure App Proxy, anyone used any of them?

 

• ManageEngine ADSelfService Plus https://www.manageengine.com/products/self-service-password/?MEtab
  
• Dovestones Active Directory Self Service Password Reset Active Directory Password Reset, AD Self Password Reset
  

Edited July 12, 2017 by gshaw

[jthompson]

I take it from your list (and your use of the word reset) that you're after a system that will allow users to recover access after forgetting their password.

 

If so, I don't have anything I can add, but RDS can allow users to change their password remotely. They will still need to provide their existing password, but it can be used to regain access if their password has expired.

[ful56_uk]

is updating to this an option?

 

https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication

[gshaw]

I take it from your list (and your use of the word reset) that you're after a system that will allow users to recover access after forgetting their password.

 

If so, I don't have anything I can add, but RDS can allow users to change their password remotely. They will still need to provide their existing password, but it can be used to regain access if their password has expired.

 

Bit of both, some users want to change their existing password remotely (or reset with change on next logon set), some have forgotten it and others have expired e.g. over summer

 

Actually caught out by our own integration here... we use Azure AD App Proxy to publish RDWeb and SSO to it via Office 365 login... which is tied to the AD login

 

is updating to this an option?

 

https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication

 

Potentially yes, been keeping an eye on this as an alternative if Centrify ever kick us off our free plan. As far as I understand it covers the SSO piece but doesn't include any off-site password recovery \ reset features?

 

Edit: clicked one link further and same applies with AAD Premium

 

Password Writeback allows management of on-premises passwords from the cloud so all the preceeding scenarios can be performed by, or on the behalf of, federated or password synchronized users. Password Writeback requires Azure AD Premium.

 

That's the ugly side of cloud-based licensing, companies using it as an excuse to move from site-based \ FTE licensing to per-user, which is horrible for education price-wise.

Edited July 12, 2017 by gshaw

[jthompson]

@Jam_lane mentioned Dovestones in another thread. That was regarding bulk creation of users, though, so they might not be using the self service password bit.

[gshaw]

@Jam_lane mentioned Dovestones in another thread. That was regarding bulk creation of users, though, so they might not be using the self service password bit.

We use their Bulk Users tool as well, good product and very reasonably priced which made me look to see if they did a password tool as well

[ful56_uk]

i thought if you move to Azure Active Directory Pass-through Authentication you dont need your adfs servers anymore and you have to convert the domain back to standard therefore are cloud users but still authenticated from the domain? i could of miss understood this though.

 

I am about to go through this process in the next week or so, ill keep you posted.

[ful56_uk]

maybe not then

 

What happens if my user's password has expired and they try to sign in using Pass-through Authentication?

If you have configured password writeback for a specific user, and if the user signs in using Pass-through Authentication, they can change or reset their passwords. The passwords are written back to on-premises Active Directory as expected.

However, if password writeback is not configured or if the user doesn't have a valid Azure AD license assigned, the user can't update their password in the cloud. They can't update their password even if their password has expired. The user instead sees this message: "Your organization doesn't allow you to update your password on this site. Please update it according to the method recommended by your organization, or ask your admin if you need help." The user or the administrator has to reset their password in your on-premises Active Directory.

[RLR]

We setup passcore which is free: https://github.com/unosquare/passcore

[nadeem]

We use this is has a free version https://www.hypersocket.com/en/products/password-self-service (also comes a VM in a a whole bunch of flavours which makes it simple to set-up. support is good too.)

[1066girl]

We use AdSelfService with mixed success. A lot of users set this up but forget it is there when they need it, despite us having a link from our website.

[p3t3r]

We use MicroFocus Self Service Password Reset (SSPR) https://www.netiq.com/products/self-service-password-reset/

 

It's a very full featured product that we get bundled as part of Access Manager, but it can be purchased separately. As well as resetting passwords we use this for the activation of student accounts from home.

[gshaw]

We use MicroFocus Self Service Password Reset (SSPR) https://www.netiq.com/products/self-service-password-reset/

 

It's a very full featured product that we get bundled as part of Access Manager, but it can be purchased separately. As well as resetting passwords we use this for the activation of student accounts from home.

@p3t3r we actually do have this laying around in our old Novell setup but the version we have looks like it's come out the ark, is the new one more user-friendly?

[manc_techie]

We use ManageEngine with a link published via our Remote Access portal. Works easy enough but most of users forget their answers.

[rinzwind]

One thats definitely easy to implement and email based and can be enabled for a subset of users (students...) is a tool called AD Password Mail Service . So as long as your OK with email based reset you can test drive it .

[gshaw]

Went for Dovestones in the end I like their site licensing model, no per user fees or subscriptions and reasonably priced too.

 

Mobile number SMS-based reset is an interesting proposition but I've hung back from that getting into the GDPR mindset that if users haven't given agreed for their numbers to be copied into another system then we shouldn't go putting it there without getting consent via a manual registration process.

 

Shame we can't make use of AAD Premium as it has some nice added features but MS have priced it out the Education market. Seems to be the way they're going with the future 20-30% price hikes too.

Edited September 4, 2017 by gshaw

[p3t3r]

@p3t3r we actually do have this laying around in our old Novell setup but the version we have looks like it's come out the ark, is the new one more user-friendly?

 

The new SSPR is much more user friendly and mobile friendly. So far have had 1300 students successfully activate their accounts from home using SSPR this week.

[edmurphy]

I use ManageEngine