Skip to main content
Version: Omada Identity Cloud

Password reset

Enable authenticated password reset​

info

This instruction applies only to the Omada Identity Cloud solution. For on-prem instruction, refer to the section below.

Follow these steps to enable the password reset process:

  1. Go to Setup > Master Data > All systems and choose Active Directory.

  2. In the Provisioning folder, open the General Settings.

  3. Select the Enable password reset checkbox.

  4. Enable the OPS password reset client by activating the master setting PWROPSCLIENT.

note

If the self-service Change password process is in scope, it is required to validate the active users password:

  • For customers using AzureAD, this can be enabled by the master setting PWRAZUREADCLIENT. If set, the customer setting PWRAZURESYSTEMID must be configured with the SYSTEMID of the Microsoft Entra ID containing the active users (which is typically synchronized with Active Directory).

  • Likewise for validation of LDAP-enabled user repositories, use the master setting PWRLDAPCLIENT and the customer setting PWRLDAPSYSTEMID.

You can disable the validation of the active users password with the customer setting PWREnforcePWValidation. Please note that this is not recommended, as this may leave the Change password process vulnerable if a workstation is left unlocked.

Enable authenticated password reset on-prem​

Follow these steps to enable the password reset process:

  1. Go to Setup > Master Data > All systems and choose Active Directory.

  2. In the Provisioning folder, open the General Settings.

  3. Select the Enable password reset checkbox.

  4. At the bottom of the Provisioning folder, click Commit settings.

  5. Run the following query on the Enterprise Server database. Replace <enter AD system id> with the identity storage system you have chosen.

In the following example, we have used AD System ID:

IF NOT EXISTS (SELECT * FROM [dbo].[tblCustomerSetting] WHERE [key] = 'PWRADSYSTEMID')        BEGIN
            INSERT INTO [dbo].[tblCustomerSetting]([Key],[Name],[Description],[ValueStr],[Type],[Category],[IsPublic])
            VALUES ('PWRADSYSTEMID','Password AD Client SystemID','','<enter AD system id>',0,'Password Reset',0)
        END
    IF NOT EXISTS (SELECT * FROM [dbo].[tblMasterSetting] WHERE [key] = 'PWRADCLIENT')
    BEGIN
        INSERT INTO [dbo].[tblMasterSetting]([Key],[Name],[Description],[ValueBool],[Type])
        VALUES ('PWRADCLIENT','Password reset AD client','Enable the password reset AD client',1,0)
    END
    ELSE
    BEGIN
            UPDATE [dbo].[tblMasterSetting] SET [ValueBool] = 1 WHERE [key] = 'PWRADCLIENT'
    END
    IF NOT EXISTS (SELECT * FROM [dbo].[tblMasterSetting] WHERE [key] = 'PWROPSCLIENT')
    BEGIN
            INSERT INTO [dbo].[tblMasterSetting]([Key],[Name],[Description],[ValueBool],[Type])
            VALUES ('PWROPSCLIENT','Password reset via Provisioning Service','Execute password reset actions via the Omada Provisioning Service',1,0)
    END
    ELSE
    BEGIN
            UPDATE [dbo].[tblMasterSetting] SET [ValueBool] = 1 WHERE [key] = 'PWROPSCLIENT'
END
info

Passwords must be reset individually for each account: it is not possible to reset passwords for multiple accounts simultaneously.

Per-account resource password reset configuration​

Thanks to resource password reset configuration on a per-account basis, administrators can control which account resources are available in the Password Reset account grid (used in the Authenticated password reset process).Per-account resource password reset configuration allows administrators to control which account resources are available in the Password Reset account grid (used in the Authenticated password reset process).

The feature uses the existing Enabled for password reset property, with the system name PWR_SYSENABLED, at resource level. This provides more granular control than enabling password reset for every account resource belonging to an enabled system.

How it works​

The configuration mode is determined by whether PWR_SYSENABLED is bound to the Resource data object type.

System-level configuration

When PWR_SYSENABLED is not bound to the Resource data object type:

  • The existing system-level configuration is used.
  • Relevant account resources from systems where Enabled for password reset is enabled are available in the Password Reset account grid.
  • Existing installations continue to behave as before.

Resource-level configuration

When PWR_SYSENABLED is bound to the Resource data object type:

  • Resource-level configuration takes precedence over system-level configuration.
  • Only account resources where PWR_SYSENABLED = true are available in the Password Reset account grid.
  • Account resources where the value is False, or is not explicitly set to True, are excluded.
  • Assignments referencing excluded account resources are not loaded into the grid.
  • Password-policy resolution is limited to eligible account resources and their associated systems.
  • A dedicated validation message is displayed when no account resources are enabled.
note

Although the property is bound to the general Resource data object type, only resources with the Account resource category are considered by the Password Reset flow.

Important activation behavior​

warning

Binding PWR_SYSENABLED to the Resource data object type immediately switches password reset account selection from system-level to resource-level configuration.

The resource-level property defaults to False. Existing account resources will therefore not be available for password reset until they are explicitly enabled – even when Enabled for password reset remains active on their system.

Plan which account resources should remain available before activating resource-level configuration, and enable the required account resources immediately after adding the binding.

Use system-level configuration​

No additional configuration is required. To configure password reset at system level:

  1. Open the context menu for the system.
  2. Select Edit advanced.
  3. Open the Password reset section.
  4. Configure Enabled for password reset.
  5. Save the system.

The property system name is PWR_SYSENABLED. As long as PWR_SYSENABLED is not bound to the Resource data object type, enabled systems continue to provide their relevant account resources to the Password Reset flow.

Enable resource-level configuration​

  1. Open the Resource data object type configuration.
  2. Bind the existing PWR_SYSENABLED property to the Resource data object type.
  3. Open an account resource that should support password reset.
  4. Set Enabled for password reset to True.
  5. Save the account resource.
  6. Repeat these steps for every account resource that should appear in the Password Reset account grid.

Account resources left at False will not appear in the grid.

important

The selected identity must have an account assignment for the enabled account resource. Enabling an account resource does not make it selectable for identities without a corresponding account.

Disable resource-level configuration​

Remove the PWR_SYSENABLED binding from the Resource data object type to restore the existing system-level behavior.

After removing the binding:

  • Resource-level values are no longer used for account selection.
  • Systems where PWR_SYSENABLED = true provide their relevant account resources.
  • No migration is required to restore legacy behavior.

Backward compatibility​

Existing installations continue to use system-level password reset configuration until PWR_SYSENABLED is bound to the Resource data object type. This feature does not change behavior for installations that do not enable resource-level configuration. No migration is required for legacy operation.