Feature: Reset by Mail Challenge - Login or Mail

[fernwerker]

Is there a way to trigger the reset by mail challenge with the mail address instead of the login?

[coudot]

You can configure LDAP filter to get the user with uid or mail:

$ldap_filter = (&(objectClass=person)(|(uid={login})(mail={login})))

With this, user can enter either mail or uid to change or reset password.

[plewin]

On the same topic, I am thinking about a new universal reset page to replace all change/reset pages (change password, reset by email, reset by sms, reset by questions)

I would like to offer end users a completely different experience.

The Universal Reset will start with only one text field.
In the text field, the user can enter a login, an email or a phone number.

SSP will search for a match. If there is a match the user details login, sms, email will be displayed.
Depending on SSP configuration and the LDAP entry attributes, the user will see multiple challenges.
Also thanks to asking the user first, we can tell if the account is disabled or do not have a phone number and also load a password policy specific to the user.

Possible challenges would be previous password, email to user, N questions, sms, TOTP.
Administrators would choose what and how many challenges are shown.

The closest to what I imagine is twitter's reset password page.
https://twitter.com/account/begin_password_reset

About privacy, details of mail/login/phone number would have parts that can be masked. It would be also possible to not show any details and say that a SMS or email with futher instructions has been send.

[muzzol]

wow, I totally forgot about my original problem (#307)

I agree that all pages could be merged to avoid any confusion to users.
one single field with an editable description like User/Mail/WhateverID and internally use ldap filtering to get desired dn.

the only drawback is the possibility of getting more than one dn if for example two users share a single mail address, but I think that's up to any administrator to allow/manage that kind of collisions.

regarding my original bug, I use a lot of posthook scripts and I need all info I can get from a DN so I don't need to perform additional searches. I tipically use: full DN, UID, CN, SN, MAIL, MEMBEROF

for example, I use memberof to determine if I should execute additional posthook scripts if user belongs to a group.

merci for your time @coudot

[coudot]

Maybe you need more posthook arguments, like what is described in #249

[muzzol]

yeah, that could do it.

I've seen other projects that take the variable approach, you expose all variables with a known prefix and you don't need fixed arguments.
with that approach is very easy to make scripts with only arguments you need.

something like:

#!/bin/bash

USERDN="$LTB_DN"
USERMAIL="$LTB_MAIL"
USERID="$LTB_UID"
...