Creating Users Using the Ask Password Option

This section is about the user creation flow which allows users to decide their own passwords. This process is initiated by the administrator when selecting Ask password from user during the user creation process. This is different from the default flow, in which the administrator decides the passwords for users. Using the Ask Password option is the standard method for user management as the administrator does not have to remember and specify passwords when creating an account for a user. When selecting this option, the administrator must enter an Email Address. The Identity Server sends an email to this address that provides the users with a redirection URL. This directs the users to a screen where they can provide the password for the account that was newly created for them by the administrator. 

Follow the instructions given below to configure this feature. 

<EventListener type="org.wso2.carbon.user.core.listener.UserOperationEventListener" name="org.wso2.carbon.identity.mgt.IdentityMgtEventListener" orderId="50" enable="false"/>
<EventListener type="org.wso2.carbon.user.core.listener.UserOperationEventListener" name="org.wso2.carbon.identity.governance.listener.IdentityMgtEventListener" orderId="95" enable="true" />
<EventListener type="org.wso2.carbon.user.core.listener.UserOperationEventListener" name="org.wso2.carbon.identity.governance.listener.IdentityStoreEventListener" orderId="97" enable="true">

Follow the steps given below to configure WSO2 IS to enable the ask password feature:

1. Add the configuration Make sure the following configuration is set (uncommented) in the <IS_HOME>/repository/conf/identity/identity.xml file under <Server> element to set the redirection URL valid time period in minutes. 
   The redirection link that is provided to the user to set the password is invalid after the time specified here has elapsed. 

   <Server xmlns="http://wso2.org/projects/carbon/carbon.xml">
   ...
      <AskPassword>
         <ExpiryTime>1440</ExpiryTime>
      </AskPassword>
   ...
   </Server>

   You can also configure the expiry time through the Management Console.

    Click to see how to configure this through the management console

   1. Start the Identity Server and login to the Management Console.

   2. Click Resident under Identity Providers on the Main tab and expand the Account Management Policies tab. 

   3. Expand the User Onboarding tab and configure the Ask password code expiry time field. Click Update to save changes. 

2. Optionally, if you are adding users via the management console, the EnableAskPasswordAdminUI property value needs to be added to the <IS_HOME>/repository/conf/identity/ identity.xml file.

   <EnableAskPasswordAdminUI>true</EnableAskPasswordAdminUI>

3. Configure the email settings in the <IS_HOME>/repository/conf/output-event-adapters.xml file. 

   mail.smtp.from	Provide the email address of the SMTP account. Example: abcd@gmail.com
   mail.smtp.user	Provide the username of the SMTP account. Example: abcd
   mail.smtp.password	Provide the password of the SMTP account.

   <adapterConfig type="email">
       <!-- Comment mail.smtp.user and mail.smtp.password properties to support connecting SMTP servers which use trust
           based authentication rather username/password authentication -->
       <property key="mail.smtp.from">{EMAIL_ID}</property>
       <property key="mail.smtp.user">{USERNAME}</property>
       <property key="mail.smtp.password">{PASSWORD}</property>
       <property key="mail.smtp.host">smtp.gmail.com</property>
       <property key="mail.smtp.port">587</property>
       <property key="mail.smtp.starttls.enable">true</property>
       <property key="mail.smtp.auth">true</property>
       <!-- Thread Pool Related Properties -->
       <property key="minThread">8</property>
       <property key="maxThread">100</property>
       <property key="keepAliveTimeInMillis">20000</property>
       <property key="jobQueueSize">10000</property>
   </adapterConfig>

   If you are using a Google mail account, note that Google has restricted third-party apps and less secure apps from sending emails by default. Therefore, you need to configure your account to disable this restriction, as WSO2 IS acts as a third-party application when sending emails to confirm user registrations or notification for password reset WSO2 IS.

    Click here for more information.

   Follow the steps given below to enable your Google mail account to provide access to third-party applications.

   1. Navigate to https://myaccount.google.com/security.
   2. Click Signing in to Google on the left menu and make sure that the 2-step Verification is disabled or off.
      
   3. Click Connected apps and sites on the left menu and enable Allow less secure apps.
      

   Tip: The email template used to send this email notification is the AskPassword template.

   You can edit and customize the email template. For more information on how to do this, see Customizing Automated Emails.

4. Start the Identity Server and log in to the Management Console.

5. In the Main tab, click, under Identity Providers, click Resident and expand the Account Management Policies tab. 

6. Expand the User Onboarding tab and select Enable User Email Verification. Click Update to save changes. 

   The EmailVerification property can be enabled for each tenant at tenant creation by adding the following configuration to the <IS_HOME>/repository/conf/identity/identity.xml file as seen below.

   <EmailVerification>
           <Enable>true</Enable>
           <LockOnCreation>true</LockOnCreation>
           <Notification>
               <InternallyManage>true</InternallyManage>
           </Notification>
       </EmailVerification>

Try it out

You can use one of the following methods to creating a user using the ask password option.