Page Comparison

...

To recover with notification:

Edit the identitymgtidentity-mgt.properties file with the following configuration under {carbon_home}/repository/conf/security.

Code Block

language	java

Identity.Listener.Enable=true
Notification.Sending.Enable=true
Notification.Expire.Time=3 # expire the recovery after 3 minutes.
Notification.Sending.Internally.Managed=true
UserAccount.Recovery.Enable=true
Captcha.Verification.Internally.Managed=false # set this to true if you do not have existing captcha validation module

Edit the emailadminconfigemail-admin-config.xml file with the following configuration under {carbon_home}/repository/conf/email.

Define a email format with the type “passwordReset”. The following is a sample format:

Code Block

language	html/xml

<configuration type="passwordReset">
	<targetEpr>https://localhost:9443/carbon/adminmgt/validator_ajaxprocessor.jsp</targetEpr>
	<subject>Password Reset Notification</subject>
	<body>
		Hi {firstnamefirst-name}
		We received a request to change the password on the {usernameuser-name} account
		associated with this email address. If you made this request, please click
		the link below to securely change your password:


		{passwordresetlinkpassword-reset-link}


		If clicking the link doesn't seem to work, you can copy and paste the link
		into your browser's address window.


		If you did not request to have your {usernameuser-name} password reset, simply
		disregard this email and no changes to your
		account will be made.
	</body>
	<footer>
		Best Regards,
		WSO2 Carbon Team Teamhttphttp://www.wso2.com
	</footer>
	<redirectPath></redirectPath>
</configuration>

The email sent to user includes the {passwordresetlinkpassword-reset-link} replaced with the URL defined within the targetEprtag appending the confirmation={key} which the Identity Server API caller needs to pass along with the user name.

Edit the axis.xml with the following configuration under {carbon_home}/axis2/. Uncomment the following in the file and provide the necessary email settings.

Code Block

language	html/xml

<transportSender name="mailto"
class="org.apache.axis2.transport.mail.MailTransportSender">
	<parameter name="mail.smtp.from">chamathtest@gmail>sampleemail@gmail.com</parameter>
	<parameter name="mail.smtp.user">chamathtest@gmail>sampleemail@gmail.com</parameter>
	<parameter name="mail.smtp.password">password</parameter>
	<parameter name="mail.smtp.host">smtp.gmail.com</parameter>
	<parameter name="mail.smtp.port">587</parameter>
	<parameter name="mail.smtp.starttls.enable">true</parameter>
	<parameter name="mail.smtp.auth">true</parameter>
</transportSender>

Recovering the password with email notification can be achived achieved using the exposed UserInformationRecoveryService exposed UserInformationRecoveryService where the WSDL can be found in the following URL of your Identity Server installation: https://localhost:9443/services/UserInformationRecoveryService?wsdl.

The service security is implemented using Captcha and confirmation codes having expiryexpire after a while. Also for each communication, the generated confirmation code will be is not reused the by the service. This makes the services secure and fails repeated attempts to access the same service. Hence the sequence of calls which the Calling Application must do is as follows for email-based recovery.:

getCaptcha() - Generates a captcha.
verifyUser() - Validates the captcha answer and username and returns a new key.
sendRecoveryNotification() - Send an email notification with a confirmation code to the user. Need to provide the key from previous call.
getCaptcha() - Generates a captcha when the user clicks on the URL.
verifyConfirmationCode() - Validates the captcha answer and confirmation code. This returns a key.
updatePassword() - Updates the password in the system. Need to provide the key from previous call, new password and returns the status of the update, true or false.

...

Versions Compared

Old Version 2

New Version Current

Key