Password Recovery Using Challenge Questions

This section guides you through setting up password recovery for users to recover a lost or forgotten password. There are two methods of password recovery:

• Recovery using notifications
• Recovery using challenge questions

This document guides you on setting up recovery using challenge questions. For instructions on recovery using notificatios, see Password Recovery Using Notifications.

Recovery using challenge questions

The WSO2 Identity Server provides an alternative means of recovering passwords. This is by using challenge questions. If users forget their password, they can recover it by answering challenge questions that were set up for their accounts.

Before setting this up, you must configure the required claims for this feature. To do this, do the following.

1. Enter your username and password to log on to the Management Console.
2. Click on Resident found under the Identity Providers section on the Main tab of the Management Console.
3. Expand the Account Management Policies tab, then the Account Recovery tab and select the Enable the Security Questions Based Password Recovery checkbox. 

4. Configure the required number of questions in the Number of Questions Required for Password Recovery. 
   Optionally, select the Notify when Questions Based Recovery Starts checkbox to send an email notification to the user when the question based recovery starts. 

You can set up challenge questions for users in one of the following ways: 

Using the management console

To set up challenge questions or to manage the questions with different locales (languages), see Managing Challenge Questions. 

Using the end user dashboard

To try this out, first create a user in the Identity Server.

1. On the Main tab in the Management Console, click Add under Users and Roles.
   
2. Click Users. This link is only visible to users with the Admin role. 
   

3. Click Add New User.
   

4. Log out of the Identity Server.
5. The URL for accessing dashboard is the following if the hostname is localhost and the Identity Server is running on port 9443: https://localhost:9443/dashboard/. Click this link to access the dashboard and log in using the credentials of the user you just created.
   
   
6. Click the View Details button under the Account Recovery section in the end user dashboard.
    
7. Set challenge questions for the user account. There are two sets of challenge questions by default. You can pick one question for each set and give an answer for the question.
   
   
8. Click Update.
9. Sign out of the dashboard and click Forgot Password on the login screen.  
   

10. Enter the username and select Recover with Security Questions. Click Submit. 

    Tip: If you have configured WSO2 IS to use email address as the username, enter the username in the format of "john@foo.com". If the user is in the super tenant, this is in the format of "john@foo.com@carbon.super". If the user is in the tenant bar.com, the format you must enter is "john@foo.com@bar.com".

    

11. Enter the answers to the challenge questions and click Submit. 
    
12. Enter a new password and click Submit. You will receive a notification of successful password reset.