Configuring reCaptcha for Challenge Question-Based Password Recovery

This topic guides you through configuring reCaptcha for secret questions in the password recovery flow. By configuring reCaptcha, you can mitigate or block brute force attacks.

For more information on setting up password recovery with secret questions, see Password Recovery.
For more information on brute force attacks, see Mitigating Brute Force Attacks.

Set up reCaptcha with the WSO2 Identity Server. For instructions on how to do this and more information about reCaptcha, see Setting Up ReCaptcha.
Start the WSO2 IS Server and login to the management console.
Click Resident under Identity Providers found in the Main tab.
Expand the Account Management Policies tab and then expand the Account Recovery tab.
Select Enable reCaptcha for Security Question Based Password Recovery to enable reCaptcha for account recovery.
Configure the Max Failed Attempts for ReCaptcha.

Note: This value should be less than the number of failed attempts configured in the account locking connector.
You have now successfully configured reCaptcha for the password recovery with secret questions flow. The reCaptcha will be prompted if the user reaches the limit of max failed attempts when providing an answer to a secret question. For instance, since the Max Failed Attempts for ReCaptcha was configured as 2 above, if the user answers a question incorrectly twice, the reCaptcha will be prompted as seen in the window below.