> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/security/password-recovery.md).

# Configure password recovery and account unlock

Configure forgot-password, forgot-username, security questions and account unlock with the real policy parameters, property keys and audit actions.

## What this is, and when you need it

Two signed-out flows share one set of settings. **Recovery** lets a user who has forgotten their password prove identity through OTP, a mailed token or security questions, and set a new one. **Unlock** lets a user whose `LOGIN.LOCK_MARKER` is set prove identity through any accepted factor — and it is a *rule*, `UNLOCK_ACCOUNT_RULE`, not a form.

The parameters for both live on the **password policy** in the `FORGET_PSWD` group, plus a handful of `Password` and `ChallengeResponse` system properties. Design the policy first in [Password policy](/administration-guide/security/password-policy.md); this page is the operational half. A technician verifying a caller before opening their profile is a separate feature: [Verify a help-desk caller](/administration-guide/security/helpdesk-verification.md). Rotating a database or broker secret is not a password reset — that is [Rotate service credentials](/administration-guide/security/rotate-service-credentials.md).

## At a glance

|                          |                                                                                                                                                                                             |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **You will end up with** | A signed-out **Forgot your password?** path that offers only recovery factors, issues a token with an expiry you chose, and lets a disposable test identity set a new password              |
| **Where**                | **Policy → Password Policy → 4000** for the parameters; **Access Control → Content Providers →** your provider **→ URI Patterns →** `/idp/resetPasswordForm` for the factors offered        |
| **You need first**       | The password policy that resolves for the test population, a tested OTP channel and working mail, and a disposable non-administrator identity with a default email address and an OTP phone |
| **Takes**                | Two to three hours, most of it building a recovery-only authentication rule and testing each factor                                                                                         |
| **Reversible**           | Yes for the settings. **No** for a reset that has already happened — a password cannot be rolled back to a previous value; issue a fresh recovery event and revoke sessions instead         |

{% hint style="warning" %}
**`NUM_DAYS_FRGT_PWD_TOKEN_VALID` ships with no value, and the fallback is 3 days.** When OpenIAM cannot read the attribute as an integer — including when it is simply absent — it records *"Can't parse the '%s' policy attribute. Either it's not an integer, or it doesn't exist. Defaulting…"* in the ESB log and uses three days. Your mailed reset links live three days out of the box. The field on the policy screen shows blank, not 3, so the log line and the token's own expiry column are the only places the real value shows up.

The same parameter has a **second, unrelated job**. When `CHNG_PSWD_ON_RESET` is `false`, or the reset came from an activation link, the new password's age comes from `PWD_EXPIRATION`; otherwise it comes from `NUM_DAYS_FRGT_PWD_TOKEN_VALID`. Setting the token validity to 1 therefore also gives an administrator-reset password a one-day life when change-after-reset is on. Check `LOGIN.PSWD_RESET_TOKEN_EXP` and the user's password expiry together after you change it.
{% endhint %}

## Configure the recovery path

{% stepper %}
{% step %}

### Set the token validity explicitly

On **Policy → Password Policy → 4000**, set `NUM_DAYS_FRGT_PWD_TOKEN_VALID` to the number of days your standard allows. Leaving it blank is not "no expiry"; it is three days, silently, and it also governs the life of an administrator-reset password when `CHNG_PSWD_ON_RESET` is on.
{% endstep %}

{% step %}

### Raise the answer floor and set the question counts

`MIN_ANSWER_LENGTH` ships `1`, which permits a one-character answer. Raise it. Then decide the two counts, which are separate parameters and both ship `3`: `QUEST_COUNT` is how many questions are *displayed*, `QUEST_ANSWER_CORRECT` is how many must be *right*. `CUSTOM_QUEST_COUNT` and `CUSTOM_QUEST_ANSWER_COUNT` are the user-defined-question equivalents, also `3` each.
{% endstep %}

{% step %}

### Confirm recovery is reachable at all

`org.openiam.ui.password.unlock.enabled` is read at the top of `/idp/unlockAccount` and returns a bare `404` when false. It ships `true`. `org.openiam.forgot.username.enabled` ships `true` and governs the username variant, whose redirect target is `org.openiam.forgot.username.redirect.url` = `/selfservice`.

**Forgot your password?** appears on the password screen only when the unlock property is `true` **and** the login already typed resolves to an `ACTIVE` user holding at least one active login — so a user who was never activated sees no link.
{% endstep %}

{% step %}

### Build a recovery-only authentication rule and bind the pattern to it

This is the step that decides which factors the user is actually offered, and the shipped binding is wrong for the purpose. See [The URI pattern decides which factors the user is offered](#the-uri-pattern-decides-which-factors-the-user-is-offered) immediately below: build a rule on **Policy → Authentication Rule** whose steps are recovery factors only — `EMAIL_AUTH`, `SMS_AUTH`, `CHALLENGE_RESPONSE_AUTH` — and bind the `/idp/resetPasswordForm` URI pattern to that rule.

An OTP step also needs the provider selected under **Supported OTP Providers** on the authentication provider, and working mail.
{% endstep %}

{% step %}

### Decide which managed systems the reset screen offers

The screen lists a managed system only when the user has an **active** login on it *and* that system has **Show on User Change Password Screen** ticked (**Provisioning → Managed System**), which ships ticked. Untick it where you do not want resets offered — see [Which managed systems the reset screen offers](#which-managed-systems-the-reset-screen-offers).
{% endstep %}

{% step %}

### Review the two settings that weaken or bypass recovery

`org.openiam.ui.user.reset.password.displayAfterReset` ships `false`. Leave it false.

`org.openiam.ui.otp.sms.resource.entitlement.name.skip.id` ships `SKIP_SMS_OTP`: grant that resource to a user and OTP is bypassed for them. It is a resource ID, not a boolean, and it is a bypass — audit who holds it before you go live.
{% endstep %}

{% step %}

### Edit the unlock rule, if unlock is in scope

`UNLOCK_ACCOUNT_RULE`, *"Def. account unlock"*, ships as an any-of rule with **eleven root steps**, each edging to one `AUTHORIZATION_ACCEPT`: `CERT_AUTH`, `KERB_AUTH`, `PUSH_AUTH`, `SMS_AUTH`, `TOTP_AUTH`, `WEB_AUTH`, `PASSWORD_AUTH`, `EMAIL_AUTH`, `CHALLENGE_RESPONSE_AUTH`, `VOICE_AUTH`, and `CRIIPTO_AUTH` added later in 4.2.2.0. Sibling roots mean *or*, so any one of them unlocks.

**Remove the roots your population cannot satisfy, and look hard at `PASSWORD_AUTH`.** Its presence means the shipped flow accepts the password on the account that is locked — which is not a proof of identity independent of the lockout, and defeats the lock for the commonest lockout cause. Edit the rule on **Policy → Authentication Rule**: there is no separate unlock setting, and the rule graph is the only place any of this is visible.
{% endstep %}

{% step %}

### Test the whole path with the disposable identity

Request a reset. Confirm the mail arrives, the link works once, a second request invalidates the first mail, an expired token is refused with `401`, and the new password is validated against the policy. Then lock the account deliberately and confirm the unlock rule offers a factor the user can satisfy.
{% endstep %}
{% endstepper %}

## The URI pattern decides which factors the user is offered

`/idp/resetPasswordForm` is a protected URL, not a form of its own: the authentication rule bound to its URI pattern decides which factors the user may choose from, and reaching the page at all means one of them was satisfied. Set that list at **Access Control → Content Providers →** your provider **→ URI Patterns →** `/idp/resetPasswordForm`, choosing a rule built at **Policy → Authentication Rule**.

The shipped binding is the rule named **Any authentication** (`DEF_ANY_AUTH_RULE`), whose root steps are `CRIIPTO_AUTH`, `PASSWORD_AUTH`, `WEB_AUTH` and `CERT_AUTH`. So out of the box the screen offers authentication types most deployments do not use, and offers **Password** to a user who has just said they have forgotten it — choosing it asks for the password again and returns them to the login page.

{% hint style="warning" %}
**`org.openiam.ui.reset.password.methods` is inert.** It ships `SMS,EMAIL,CHALLENGE_RESPONSE` and looks exactly like the setting that decides which recovery methods the signed-out screen offers. Nothing in the product reads its value, so editing it changes nothing. The decision belongs to the URI pattern's authentication rule, above.
{% endhint %}

## Verification

| What to check                                      | How                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Recovery is reachable                              | `/idp/unlockAccount` does not answer `404` in a browser. A `404` means `org.openiam.ui.password.unlock.enabled` is false                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| The offered methods are what you configured        | The signed-out screen shows exactly the steps of the authentication rule bound to the `/idp/resetPasswordForm` URI pattern                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| A token was issued and will expire when you expect | `SELECT PSWD_RESET_TOKEN, PSWD_RESET_TOKEN_EXP FROM LOGIN WHERE LOGIN='<TEST_USER>'`. Expiry three days out means `NUM_DAYS_FRGT_PWD_TOKEN_VALID` is unset                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| The token was not logged in the clear              | The `USE_RESET_PASSWORD_TOKEN` event carries `EMAIL_TOKEN` masked to the last four characters                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| The target accepted the new password               | The connector reply in `RESET_PASSWORD_CONNECTOR_RESPONSE` and the account on the managed system                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Audit records exist                                | `FORGOT_PASSWORD`, `FORGOT_USERNAME`, `ANSWER_CHALLENGE_RESPONSE_QUESTIONS`, `USE_RESET_PASSWORD_TOKEN`, `RESET_PASSWORD_FORM_SUBMIT`, `USER_RESET_PASSWORD`, `USER_RESET_SECURITY_QUESTIONS`, `USER_RESET_ACCOUNT`, `RESET_PASSWORD_FOR_RELATED_ACCOUNT`, `USER_ACCOUNT_LOCKED`, `INCREMENT_FAIL_AUTH_COUNT`, `USER_RESET_PASSWORD_ON_BEHALF` and `RESET_PASSWORD_CONNECTOR_RESPONSE`. `UNLOCK_PASSWORD` and `ANSWER_UNLOCK_PASSWORD_QUESTIONS` have been deprecated since 4.2.1 — do not build alerting on them. See [Audit actions and retention](/administration-guide/reference/audit-actions-and-retention.md) |

## When it goes wrong

| Symptom                                                                                                                    | Cause                                                                                                                                                          | Fix                                                                                                                                                                                            |
| -------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `/idp/unlockAccount` answers `404`                                                                                         | `org.openiam.ui.password.unlock.enabled` is `false`                                                                                                            | Set it `true`; it ships `true`                                                                                                                                                                 |
| Reset link expires in three days and no field explains it                                                                  | `NUM_DAYS_FRGT_PWD_TOKEN_VALID` is empty; the fallback is `3`                                                                                                  | Set the parameter                                                                                                                                                                              |
| Setting token validity to 1 shortens administrator-reset password life too                                                 | The same parameter is reused as the new password's expiration when `CHNG_PSWD_ON_RESET` is on                                                                  | Decide both together, or set `CHNG_PSWD_ON_RESET` to `false` and let `PWD_EXPIRATION` apply                                                                                                    |
| The forgot-password screen offers authentication types you do not use, and choosing one returns the user to the login page | The `/idp/resetPasswordForm` URI pattern is bound to the shipped **Any authentication** rule, whose steps include `PASSWORD_AUTH`                              | Bind the pattern to a rule whose steps are recovery factors only — [The URI pattern decides which factors the user is offered](#the-uri-pattern-decides-which-factors-the-user-is-offered)     |
| A method is missing from the recovery screen, and editing `org.openiam.ui.reset.password.methods` changes nothing          | Nothing reads that property                                                                                                                                    | Add the factor as a step on the pattern's authentication rule instead                                                                                                                          |
| No mail arrives after the user asks for a reset                                                                            | Mail, not recovery: no active mailbox configuration, or several active ones taking turns so the send left from an account you did not expect                   | Send a test message from **Administration → Mailbox Configurations** — see [Which configuration is used](/administration-guide/platform/mail-and-notifications.md#which-configuration-is-used) |
| A user clicks "forgot password" twice and the first mail stops working                                                     | The token is per-identity and single-valued; issuing a new one overwrites the old                                                                              | Expected. Tell the user to use the most recent mail                                                                                                                                            |
| The reset screen offers a managed system you do not want reset there                                                       | **Show on User Change Password Screen** on that managed system ships ticked                                                                                    | Untick it; the user must also hold an active login on a system for it to be listed at all                                                                                                      |
| A locked account can be unlocked with the password that is locked                                                          | `PASSWORD_AUTH` is one of `UNLOCK_ACCOUNT_RULE`'s eleven shipped roots, and sibling roots mean *or*                                                            | Delete that root step from the rule. Nothing else has to change                                                                                                                                |
| A locked user has no way to unlock after you edited the rule                                                               | Every remaining root demands a factor that population does not hold                                                                                            | Open the rule graph and add one they do — the graph is the only place the offered factors are visible                                                                                          |
| History violation message says nothing useful                                                                              | `org.openiam.ui.user.password.show.generic.message.history.rule.flag` ships `true`, so a history violation shows a generic message rather than naming the rule | Set it `false` in non-production while diagnosing                                                                                                                                              |
| A user bypasses OTP entirely                                                                                               | They hold the resource named by `org.openiam.ui.otp.sms.resource.entitlement.name.skip.id` (`SKIP_SMS_OTP`)                                                    | Review who is entitled to that resource                                                                                                                                                        |
| User resets in OpenIAM but a target still has the old password                                                             | Managed-system selection on the reset form, or the connector failed                                                                                            | Check `RESET_PASSWORD_CONNECTOR_RESPONSE` and the policy map                                                                                                                                   |

## Roll it back

Restore the recorded `FORGET_PSWD` values and the `ChallengeResponse` properties, and re-test with the disposable identity. Rebinding the `/idp/resetPasswordForm` URI pattern to its previous rule is the one change that immediately restores the previous set of offered factors. A password reset itself cannot be rolled back to a previous value: issue a fresh recovery event and revoke sessions instead — see [Terminate a user's sessions](/administration-guide/security/session-management.md).

## What the recovery flow does, end to end

| Order | What happens                                                                                                                                                                                                                                                                                                                                                                                                     | Where you see it                                                     |
| ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------- |
| 1     | The user clicks **Forgot your password?**, which appears only for an `ACTIVE` user with at least one active login. This is also the only place OpenIAM's sign-in screens distinguish a known account from an unknown one — the sign-in failure itself never does, because the message is always `Invalid Login and/or Password` whichever half was wrong                                                         | The signed-out screen                                                |
| 2     | The user identifies themselves. `org.openiam.idp.unlock.password.email.enabled` ships `true`, so an email address is accepted in place of the principal                                                                                                                                                                                                                                                          | —                                                                    |
| 3     | The URI pattern's rule decides which factors are offered, and one must be satisfied to reach the form. Answering the security questions is audited `ANSWER_CHALLENGE_RESPONSE_QUESTIONS`                                                                                                                                                                                                                         | The pattern's **Authentication rules** list                          |
| 4     | On the email path OpenIAM resolves the password policy from the managed system, the principal and the content provider, reads `NUM_DAYS_FRGT_PWD_TOKEN_VALID` (defaulting to three days), generates a random token and writes it to `LOGIN.PSWD_RESET_TOKEN` with its expiry in `LOGIN.PSWD_RESET_TOKEN_EXP`. The token is per-identity and single-valued                                                        | Those two columns                                                    |
| 5     | The user follows the mailed link, which lands on `/idp/validate-email-token` (also reachable as `/validateEmailToken`). Validating it is audited `USE_RESET_PASSWORD_TOKEN`, recording the token **masked** to its last four characters. A missing or unmatched token is refused with `401`, and `/idp/prevalidate-email-token` is the variant that checks without consuming                                     | The audit event                                                      |
| 6     | The user sets a new password on the reset form, validated against the resolved policy. `PWD_HIST_VER` applies, and by default the rejection message is generic                                                                                                                                                                                                                                                   | [Password policy](/administration-guide/security/password-policy.md) |
| 7     | If the account was locked, `UNLOCK_ACCOUNT_RULE` decides how it is unlocked — any **one** of its eleven shipped roots suffices. `/idp/unlockAccount` is a placeholder URL rather than a screen: reaching it means the rule was satisfied, after which OpenIAM clears the unlocking state and redirects to the postback URL, refusing any postback that does not start with `/` as a cross-site-scripting attempt | The rule graph                                                       |

## The `FORGET_PSWD` parameters, with shipped values

Eleven parameters carry the group value `FORGET_PSWD`. These are the values on policy `4000` — read your own on **Policy → Password Policy → 4000**, since an upgraded deployment may already have been tuned:

| Parameter                       | Policy `4000` | What it controls                                                                             |
| ------------------------------- | ------------- | -------------------------------------------------------------------------------------------- |
| `MAX_OTP_RESEND_ALLOWED`        | `3`           | How many times the user may ask for the OTP again before the account is temporarily locked   |
| `OTP_SMS_LIFETIME`              | `30`          | SMS OTP lifetime                                                                             |
| `ACCOUNT_LOCK_TIME`             | `15`          | How long the temporary lock from exhausted resends lasts                                     |
| `CUSTOM_QUEST_COUNT`            | `3`           | How many questions the user is asked to *define*                                             |
| `CUSTOM_QUEST_ANSWER_COUNT`     | `3`           | How many answers the user must supply                                                        |
| `FAILED_QUESTION_COUNT`         | `3`           | Wrong answers tolerated on the user-facing question flow                                     |
| `MIN_ANSWER_LENGTH`             | `1`           | Minimum answer length. `1` is effectively no floor                                           |
| `USER_DRIVEN_RESET`             | `false`       | Whether the user chooses how the password is reset, rather than the system deciding          |
| `NUM_DAYS_FRGT_PWD_TOKEN_VALID` | *(empty)*     | Days a mailed reset token stays valid. Empty means 3                                         |
| `REQUIRED_HELPDESK_QUESTION`    | `2`           | Used by [Verify a help-desk caller](/administration-guide/security/helpdesk-verification.md) |
| `FAIL_ATTEMPTS_HELPDESK`        | `3`           | Used by [Verify a help-desk caller](/administration-guide/security/helpdesk-verification.md) |

Two further parameters used by recovery sit outside the group: `QUEST_COUNT` (`3`) and `QUEST_ANSWER_CORRECT` (`3`) are ungrouped, and `QUEST_SRC` (`USER`) and `QUEST_LIST` (empty) are in group `SELFSERVE`. The complete table with parameter IDs is [Password and authentication policy parameters](/administration-guide/reference/policy-parameters.md).

## Security questions: source and counts

| Setting                                            | Shipped   | Where                                                                                                                           |
| -------------------------------------------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------- |
| `QUEST_SRC`                                        | `USER`    | Policy parameter, group `SELFSERVE`. `USER` means the user supplies their own questions rather than picking from a curated bank |
| `QUEST_LIST`                                       | *(empty)* | Policy parameter, group `SELFSERVE`. The curated list, used when `QUEST_SRC` is not `USER`                                      |
| `org.openiam.selfservice.challenge.response.group` | `GLOBAL`  | System property, category `ChallengeResponse`, type `ChallengeResponseGroup`, label *Default Security Question Group*           |
| `org.openiam.ui.challenge.answers.secured`         | `true`    | System property, category `ChallengeResponse`, label *Are Security Question Answers Secured?*                                   |

A custom validator is possible: `org.openiam.challenge.response.custom.validator` (category `Authentication`, type `Groovy`) ships empty, and while it is empty OpenIAM applies its built-in answer validation.

## Unlock and reset properties

Sixteen properties in the `Password` category, replayed to their final shipped values:

| Property                                                              | Shipped                        | Type     | Label                                                             |
| --------------------------------------------------------------------- | ------------------------------ | -------- | ----------------------------------------------------------------- |
| `org.openiam.ui.password.unlock.enabled`                              | `true`                         | Boolean  | Is Password Unlock Active?                                        |
| `org.openiam.idp.unlock.password.email.enabled`                       | `true`                         | Boolean  | Allow Password Unlock Using Email Address Instead of Principal?   |
| `org.openiam.forgot.username.enabled`                                 | `true`                         | Boolean  | Is Forgot Username Active?                                        |
| `org.openiam.ui.reset.password.methods`                               | `SMS,EMAIL,CHALLENGE_RESPONSE` | Select   | Reset password methods — **inert**                                |
| `org.openiam.change.password.all`                                     | `true`                         | Boolean  | Show Managed System Dropdown on Change Password Screen            |
| `org.openiam.ui.user.reset.password.option.sendByEmail.show`          | `true`                         | Boolean  | Show 'Send Password via Email' Option on Reset Password Page      |
| `org.openiam.ui.user.reset.password.option.sendByEmail.defaultValue`  | `true`                         | Boolean  | Check 'Send Password via Email' by Default on Reset Password Page |
| `org.openiam.ui.user.reset.password.option.autoGenerate.show`         | `true`                         | Boolean  | Show 'Auto-Generate Password' Option on Reset Password Page       |
| `org.openiam.ui.user.reset.password.option.autoGenerate.defaultValue` | `false`                        | Boolean  | Check 'Auto-Generate Password' by Default on Reset Password Page  |
| `org.openiam.ui.user.reset.password.displayAfterReset`                | `false`                        | Boolean  | Display Password Value After Successful Reset                     |
| `org.openiam.ui.user.reset.password.button.reSync.show`               | `true`                         | Boolean  | Show Resync Button on Reset Password Page                         |
| `org.openiam.ui.user.password.show.generic.message.history.rule.flag` | `true`                         | Boolean  | Show generic message for password history rule violations         |
| `org.openiam.ui.otp.sms.phone.require.on.create`                      | `true`                         | Boolean  | Require OTP Phone Number When Creating a New User?                |
| `org.openiam.ui.otp.email.require.on.create`                          | `true`                         | Boolean  | Require an OTP email address when creating a new user?            |
| `org.openiam.ui.otp.sms.resource.entitlement.name.skip.id`            | `SKIP_SMS_OTP`                 | Resource | Skip SMS OTP Resource                                             |
| `org.openiam.saml.authentication.use.password.auth.type.enabled`      | `true`                         | Boolean  | Use PASSWORD\_AUTH type for SAML authentication                   |

### Which managed systems the reset screen offers

The reset-password screen lists a managed system only when the user has an **active** login on it *and* that system has **Show on User Change Password Screen** ticked (**Provisioning → Managed System**), which ships ticked. Untick it where you do not want resets offered — typically the OpenIAM managed system itself, where the password of record lives in a directory, so the activation mail carries only the directory's link. `org.openiam.change.password.all` (ships `true`) decides whether the drop-down appears at all.

## Recovering the built-in administrator

Do not edit `LOGIN` directly. The password column is encrypted, history and first-login state live in other columns, and a hand-written `UPDATE` leaves an inconsistent, unaudited account that may not be able to sign in at all. There is no in-product self-service path for an administrator whose sign-in route is itself broken — which is exactly why [Change configuration safely](/administration-guide/start/change-safely.md) requires a tested break-glass account *before* you touch a provider, a rule or a content provider. The recovery utility is release- and deployment-specific and belongs to the [Installation Guide](/installation/installation.md); this guide cannot substitute a command for it.

## Related

* [Verify a help-desk caller](/administration-guide/security/helpdesk-verification.md) — the technician-side half, and the two `FORGET_PSWD` parameters this page defers
* [Password policy](/administration-guide/security/password-policy.md) — the `FORGET_PSWD` group in context, and policy resolution
* [Password and authentication policy parameters](/administration-guide/reference/policy-parameters.md) — all 59 parameters with their IDs
* [SMS and one-time passwords](/administration-guide/platform/sms-and-otp.md) — the OTP channel recovery depends on

*Applies to OpenIAM 2026.8.1. Last reviewed 7 August 2026.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/administration-guide/security/password-recovery.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.