Username Recovery

The user account recovery feature implemented in the WSO2 Identity Server helps to recover the username of the account if the user has forgotten it. This recovery process is also secured with captcha verification.

The service caller can define any number of claims that should be used in the user details verification. The first claim can be the email address and others can be the required attributes in the user registration such as first name or last name. This is helpful to search for a user if the system accepts multiple accounts with the same email address. Upon the successful verification of the user details, the user account ID is sent to the user by email.For this to be possible, the user needs to fill the details in their respective user profile such as email, first name, last name and any other required attributes.

The instructions below guide you through setting up username recovery with the WSO2 IS. 

<EventListener type="org.wso2.carbon.user.core.listener.UserOperationEventListener" name="org.wso2.carbon.identity.mgt.IdentityMgtEventListener" orderId="50" enable="false"/>
<EventListener type="org.wso2.carbon.user.core.listener.UserOperationEventListener" name="org.wso2.carbon.identity.governance.listener.IdentityMgtEventListener" orderId="95" enable="true" />
<EventListener type="org.wso2.carbon.user.core.listener.UserOperationEventListener" name="org.wso2.carbon.identity.governance.listener.IdentityStoreEventListener" orderId="97" enable="true">

1. Configure the following email settings in the <IS_HOME>/repository/conf/output-event-adapters.xml file. The email address configured here is the email account that will be used to send password recovery email notifications to users. 

   <adapterConfig type="email">
       <!-- Comment mail.smtp.user and mail.smtp.password properties to support connecting SMTP servers which use trust
           based authentication rather username/password authentication -->
       <property key="mail.smtp.from">abcd@gmail.com</property>
       <property key="mail.smtp.user">abcd</property>
       <property key="mail.smtp.password">xxxx</property>
       <property key="mail.smtp.host">smtp.gmail.com</property>
       <property key="mail.smtp.port">587</property>
       <property key="mail.smtp.starttls.enable">true</property>
       <property key="mail.smtp.auth">true</property>
       <!-- Thread Pool Related Properties -->
       <property key="minThread">8</property>
       <property key="maxThread">100</property>
       <property key="keepAliveTimeInMillis">20000</property>
       <property key="jobQueueSize">10000</property>
   </adapterConfig>

   Tip: The email template used to send this email notification is the AccountIdRecovery template.

   You can edit and customize the email template. For more information on how to do this, see Customizing Automated Emails.

2. Start the WSO2 IS server and login to the management console.

3. Click on Resident found under the Identity Providers section on the Main tab of the management console.

4. Expand the Account Management Policies tab, then the Account Recovery tab.

5. Select the Enable Username Recovery checkbox and the Enable Notification Internally Management checkbox. 
   For more information on the fields seen on this screen, see Account Recovery REST API. 
   
   

   Note

   If you apply the WUM update for WSO2 IS 5.7.0, released on the 2nd of October 2018, you can enable reCAPTCHA when you set up user name recovery.

   You can deploy /wiki/spaces/updates/pages/16318500 into production only if you have a paid subscription. If you do not have a paid subscription, you can use this feature when the next version of WSO2 Identity Server is released.

   Select the Enable reCaptcha for Username Recovery checkbox to enable reCaptcha for username recovery flow. For more instructions see, Configuring reCaptcha for Username Recovery.

   

6. To enable sending a confirmation email to the user's registered email address after the password reset, select the Notify when Recovery Success checkbox. 

   If you are using a Google mail account, note that Google has restricted third-party apps and less secure apps from sending emails by default. Therefore, you need to configure your account to disable this restriction, as WSO2 IS acts as a third-party application when sending emails to confirm user registrations or notification for password reset WSO2 IS.

    Click here for more information.

   Follow the steps given below to enable your Google mail account to provide access to third-party applications.

   1. Navigate to https://myaccount.google.com/security.
   2. Click Signing in to Google on the left menu and make sure that the 2-step Verification is disabled or off.
      
   3. Click Connected apps and sites on the left menu and enable Allow less secure apps.
      

Try out username recovery

1. Create a user using the management console. Ensure that the user has login permissions. 
2. Edit the user profile and enter an email address for the user. The email notification for password recovery is sent to the email address given here. 
3. Access the WSO2 Identity Server dashboard.
4. Click Forgot Username. 

5. Enter appropriate values in the required fields, and then click Submit. 
   

   Note

   If you apply the WUM update released on the 2nd of October 2018 for WSO2 IS 5.7.0 and enable reCAPTCHA when you set up user name recovery, you will see the following screen with the reCAPTCHA field when you click Forgot Username:

   

   • To recover the user name, enter appropriate values in the relevant fields, select I'm not a robot, and then click Submit. 

6. An email notification is sent to the user's email address with the recovered username.