To be able to use reCAPTCHA V2 on the Password Manager sites, make sure the following requirements are met:
About Password Manager
Getting Started
Different Site for Different Roles
Password Manager Components
Licensing
Checklist: Installing Password Manager
Installing Password Manager
Password Manager Architecture
Configuring Password Manager Service Account and Application Pool Identity
Enabling HTTPS
Steps to Install Password Manager
Instance Initialization
Installing Legacy Self-Service, Password Manager Self-Service, and Helpdesk Sites on a Standalone Server
FailSafe support in Password Manager
Installing Multiple Instances of Password Manager
Specifying Custom Certificates for Authentication and Traffic Encryption Between Password Manager Service and Web Sites
Step 1: Obtain and Install Custom Certificates From a TrustedWindows-Based Certification Authority
Step 2: Provide Certificate Issued for Server Computer to Password Manager Service
Step 3: Provide Certificate Issued for Client Computers to Self-Service and Helpdesk Sites
Configuring Management Policy
Configuring User Scope
Configuring Permissions for Domain Management Account
Adding Domain Connection
Specifying Advanced Options for Domain Connection
Changing Domain Management Account
Removing a Domain Connection
User Logon Requirements
Adding Secret Questions
Password Manager Components and Third-Party Solutions
Management Policies
Password Manager Service and Administration Site
Self-Service Site
Helpdesk Site
Password Policy Manager
Secure Password Extension
Offline Password Reset
Migration Wizard
Telesign
SQL Server Database and SQL Server Reporting Services
One Identity Quick Connect Sync Engine
Defender
Starling Two-Factor Authentication
RADIUS Two-Factor Authentication
Quest Enterprise Single Sign-On
Redistributable Secret Management Service
Location sensitive authentication
Password Manager permission checker
Working with Power BI templates
Password Manager Credential Checker
Typical Deployment Scenarios
Simple Deployment
Deployment of the Legacy Self-Service, Password Manager Self-Service site and Helpdesk Sites on Standalone Servers
Realm Deployment
Multiple Realm Deployment
Password Manager in Perimeter Network
Installing Password Manager in Perimeter Network with Read-Only Domain Controllers
Installing Password Manager in Perimeter Network with Reverse Proxy
Installing Password Manager in Perimeter Networ kwithout AD DS
Management Policy Overview
Password Policy Overview
Using One Identity Password Policies
Using Fine-Grained Password Policies
Applying Multiple Password Policies
Using Password Policy Manager
Secure Password Extension Overview
Locating Self-Service Site
reCAPTCHA Overview
Obtaining Self-Service Site URL from Service Connection Point
Changing Self-Service Site URL on the Administration Site
Launching User Notification
How It Works
How to Use reCAPTCHA on Password Manager Sites
System Requirements for Using reCAPTCHA
References
User Enrollment Process Overview
Questions and Answers Policy Overview
Password Change and Reset Process Overview
Resetting and Changing Password in Connected Systems
Enforcing Password History When Resetting Password
Replicating Password Changes
Data Replication
Phone-Based Authentication Service Overview
Checklist: Configuring Password Manager
Understanding Management Policies
Configuring Access to the Administration Site
Configuring Access to the Self-Service Site
Configuring Access to the Helpdesk Site
General Settings
Specifying Advanced Options for Domain Connection
Changing Domain Management Account
Removing a Domain Connection
Configuring Questions and Answers Policy
Workflow overview
Custom workflows
Custom Activities
Custom Activity Settings
Creating Custom Activities
Importing and Exporting Custom Activities
Removing Custom Activities
Self-Service Workflows
Register
Manage My Profile
Forgot My Password
Manage My Passwords
Unlock My Account
My Notifications
I Have a Passcode
Self-Service Activities Overview
Helpdesk Workflows
Authentication Activities
Display CAPTCHA
Display reCAPTCHA
Authentication Methods
Authenticate with Password
Authenticate with Q&A Profile (Random Questions)
Authenticate with Q&A Profile (Specific Questions)
Authenticate with Defender
Authenticate with Starling Two-Factor Authentication
Authenticate with RADIUS Two-Factor Authentication
Authenticate via Phone
Authenticate with Passcode
Action Activities
Register
Manage My Profile
Edit Q&A Profile
Reset Password in Active Directory
Change Password in Active Directory
Reset Password in Active Directory and Connected Systems
Change Password in Active Directory and Connected Systems
Reset password in connected systems through embedded connectors
Unlock Account
Enable Account
Force User to Change Password at Next Logon
Subscribe to Notifications
Lock Q&A Profile
Display User Agreement
Restart Workflow if Error Occurs
Issue BitLocker Recovery Key
Provide product feedback
Notification Activities
Assign Passcode
Reset Password
Unlock Account
Unlock Profile
Verify User Identity
Enforce Update of Profile
Helpdesk Activities Overview
Notification Activities
Customizing Notifications
Email User if Workflow Succeeds
Email User if Workflow Fails
Email Administrator if Workflow Succeeds
Email Administrator if Workflow Fails
User Enforcement Rules
General Settings Overview
Search and Logon Options
Import/Export Configuration Settings
Outgoing Mail Servers
Diagnostic Logging
Scheduled Tasks
Upgrading Password Manager
Invitation to Create/Update Profile Task
Reminder to Create/Update Profile Task
Reminder to Change Password Task
Active Directory Sites
Maximum Password Age Policy Task
User Status Statistics Task
Clear Old Records from Reporting Database
Environment Health Checker Task
Update RADIUS server status
Web Interface Customization
Instance Reinitialization
Realm Instances
Domain Connections
Using Domain Connections
Specifying Access Account for Domain Connections
Changing Access Account for Domain Connections
Specifying Advanced Options for Domain Connection
Removing a Domain Connection
Extensibility Features
RADIUS Two-Factor Authentication
Unregistering users from Password Manager
Working with Redistributable Secret Management account
Redistributable Secret Management Service supported platforms
Customizing Redistributable Secret Management log path
Email Templates
Upgrade Requirements
About Secure Password Extension
Upgrading Multiple Instances of Password Manager
Upgrading Password Manager
Administrative Templates
In-place upgrade
Upgrade 5.7.1 or later versions
Running the Migration Wizard
Modifying the service account
Converting Q&A Profiles
Upgrading Secure Password Extension
Upgrading Password Policy Manager
Installing Administrative Templates
Configuring Administrative Templates
Updating Administrative Templates
Removing Administrative Templates
Secure Password Extension
Configuring Access to Self-Service Site from Windows Logon Screen
Deploying and Configuring Secure Password Extension
Password Policies
Deploying Secure Password Extension
Configuring Secure Password Extension
Managing Secure Password Extension Using Administrative Templates
Uninstalling Secure Password Extension
About Password Policies
Installing Password Policy Manager
Uninstalling Password Policy Manager
Creating and Configuring a Password Policy
Managing Password Policy Scope
Deleting a Password Policy
One Identity Starling
Reporting
Reporting and User Action History Overview
Password Manager Integration
Appendixes
Setting Up Reporting Environment
Using Reports
User Action History
Managing Connections to SQL Server and Report Server
Best Practices for Configuring Reporting Services
Appendix A: Accounts Used in Password Manager
Glossary
Password Manager Service Account
Application Pool Identity
Domain Management Account
Password Policy Account
Account for Using One Identity Quick Connect
Appendix B: Open Communication Ports for Password Manager
Appendix C: Customization Options Overview
System Requirements for Using reCAPTCHA
References
User Enrollment Process Overview
To require users to register with Password Manager, you can use two enforcement rules: Invite users to create/update Q&A profiles and Remind users to create/update Q&A profiles.
To start the enrollment process, you need to enable and configure the Invite users to create/update Q&A profiles rule. This rule sends email notifications to the users specified in the rule’s scope, inviting them to create or update their Questions and Answers profiles. When configuring email notifications for this rule, you can insert a hyperlink to the Self-Service site. To add the hyperlink, enter the required URL in the email notification body. For example, http://mydomain.com/user. Note that you cannot specify the hyperlink text.
To configure the Invite users to create/update Q&A profiles enforcement rule, you need to specify the conditions under which users should be notified. For example, users are not registered with Password Manager, users’ answers are shorter than required, or users have specified the same answers for several questions. These conditions correspond to the Q&A profile settings that are part of the Q&A policy. For more information, Configuring Q&A profile settings. For more information on configuring this enforcement rule, see Invite Users to Create/Update Profiles.
The Remind users to create/update Q&A profiles enforcement rule can notify users via email and via notification dialog displayed by Secure Password Extension installed on users’ computers. When configuring this rule, you can specify several notification scenarios. For each scenario, you should set the time period since the invitation date and notification option (email or Secure Password Extension).
For example, you can configure the following scenarios:
- Users were invited 5 days ago: For this case, you may want to notify users by email only.
- Users were invited 10 days ago: For this case, you may want to notify users via Secure Password Extension only. Note, that users will not receive any email notifications during this period.
- Users were invited 20 days ago: For this case, you may want to notify users by email and via Secure Password Extension. So, starting from day 20 users will receive both emails and Secure Password Extension notifications.
For more information on configuring this enforcement rule, see Remind Users to Create/Update Profiles.
|
|
NOTE: If the user does not create or update his Q&A profile in the specified number of days, you can disable the user account. For more details see Forced Enrollment. |
If you want to configure different notification scenarios for different user groups, you can create several management policies, and within each Management Policy configure the Remind users to create/update Q&A profiles enforcement rule appropriately for different user groups.
Questions and Answers Policy Overview
Questions and Answers policy consists of secret questions and Questions and Answers profile settings. Secret questions are questions that users must answer to create their profiles and then use the profiles for authentication. You can create question lists in multiple languages. Each question list contains mandatory, optional, and Helpdesk questions. When creating profiles, users must answer all mandatory and Helpdesk questions, and a specified number of optional and user-defined questions. You can specify the required number of questions in the Q&A profile settings.
When authenticating on the Self-Service site with Q&A profiles, users can use mandatory, optional, and user-defined questions from their profiles. When a Helpdesk operator authenticates users, the operator can use mandatory and Helpdesk questions from users’ profiles.
Q&A profile settings are a collection of settings that define the number of user-defined and optional questions required for registration, minimum length of answers, encryption setting for storing answers, and others.