> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/getting-started-guide/authentication/password-policy-and-sspr.md).

# Password policy and self-service reset

Set a password policy and let users reset their own password.

**Goal:** a reviewed password policy and a complete forgot-password round trip performed by a non-admin user.\
**Time:** 45–60 minutes.\
**Prerequisites:** mailbox configuration working ([Require MFA for one URL](/getting-started-guide/authentication/mfa-for-one-url.md), step 1); non-admin test user with a mailbox.

{% stepper %}
{% step %}
**Review the password policy**

**Policy → Password Policy → Default Password Policy.** For the POC, work with the default policy rather than creating one (multiple policies resolve by priority with role/group/organization linkage — production territory). Review composition rules (length, character classes, history) and check they don't conflict with your AD domain policy — a provisioned account's `AccountPassword` must satisfy both.
{% endstep %}

{% step %}
**Configure the forgot-password parameters**

Inside the same password policy, the **Forgot password** section controls SSPR:

| Parameter                           | POC-sensible value                                                                                                                                                |
| ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Reset method                        | Email one-time link (token) — the default token validity is 3 days                                                                                                |
| OTP lifetime (if using OTP)         | default 30 minutes                                                                                                                                                |
| Challenge questions                 | number to display / correct answers required — defaults fine; 18 questions ship out of the box (add your own under Administration → Challenge Response Questions) |
| Max OTP resend attempts / lock time | keep defaults; note them for the failure test                                                                                                                     |

Decide the user experience deliberately: email link, security questions, or both. For the POC, email link is the cleanest demonstration.
{% endstep %}

{% step %}
**Make sure the test user can be reached**

The test user needs a valid email address on their profile (users imported from AD in the lifecycle POC carry their AD `mail`). If the policy requires challenge questions, log in once as the user and enroll answers.
{% endstep %}

{% step %}
**The round trip**

1. Private browser → `/selfservice` login page → **Forgot password**.
2. Identify as the test user; complete the challenge (email link or questions per your step 2 choice).
3. Receive the email; follow the link within its validity window.
4. Set a new password — the policy from step 1 is enforced on the new value.
5. Log in with the new password.

Then the failure paths worth 10 minutes: an expired/reused link is refused; wrong challenge answers lock per policy after the configured attempts; the auto-unlock (or helpdesk unlock) recovers.
{% endstep %}
{% endstepper %}

## A note on AD passwords

This page resets the **OpenIAM** password. Whether that password is pushed to AD depends on the managed system's password propagation configuration (the `AccountPassword` policy-map attribute from [Provision a test account to AD](/getting-started-guide/lifecycle/provision-test-account.md) covers creation; ongoing sync of password changes is a production design topic — see the Administration Guide's password chapter).

## If it failed

| Symptom               | Likely cause                                                                 |
| --------------------- | ---------------------------------------------------------------------------- |
| No email              | Mailbox configuration — re-run its test send; check the user's email address |
| Link says invalid     | Token expired (default 3 days) or already used                               |
| New password rejected | Composition rules — the policy text is shown next to the form                |

## You know this worked when…

{% hint style="success" %}
The non-admin user completes forgot-password end to end without admin help, and the failure paths behave as configured.
{% endhint %}

Next: [Choose your federation pattern](/getting-started-guide/federation.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/getting-started-guide/authentication/password-policy-and-sspr.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.