Password Manager 5.7.1 - Administration Guide

Q&A Policy and Authentication

When you configure the Q&A policy, you should remember that the settings you specify may affect the authentication process. The following authentication activities use the Q&A policy settings:

• Authenticate with Q&A profile (random questions) - This activity is used in self-service workflows. It relies on the number of secret questions you specify in the activity. If a user’s profile contains fewer questions, you can select whether to authenticate the user or not. For more information, see Authenticate with Q&A Profile (Random Questions).
• Authenticate with Q&A profile (specific questions) - This activity is used in self-service workflows. It relies on the specific secret questions you specify in the activity. If the specified questions cannot be found in a user’s profile, the user will not be authenticated. For more information, see Authenticate with Q&A Profile (Specific Questions).
• Authenticate with Q&A profile - This activity is used in helpdesk workflows. It relies on the specific secret questions you specify in the activity and on the Store answers using reversible encryption option that you specify in the Q&A profile settings. If the specified questions cannot be found in a user’s profile, the user will not be authenticated.

This activity uses mandatory and helpdesk questions. Answers to helpdesk questions are always stored using reversible encryption. Answers to mandatory questions are hashed, unless you select the Store answers using reversible encryption option in the Q&A profile settings. Note, that if answers to mandatory questions are hashed, you will not be able to use the activity option that specifies that helpdesk operators verify user identity by comparing the answers provided by users with the displayed answers (the Answers to the specified questions (user’s answer is shown) option). For more information, see Authenticate with Q&A Profile.

Q&A Policy and User Enforcement

The Q&A profile settings affects the Invite users to create/update Q&A profiles enforcement rule. This rule has conditions that state when users should be notified to create or update their profiles. These conditions correspond to the Q&A profile settings. For example, the User’s answers are shorter than required condition corresponds to the Minimum length of answers setting. So, when you change any of the Q&A profile settings, you can then select the corresponding condition in the rule and enforce users to create or update their profiles in accordance with the new settings. For more information, see Invite Users to Create/Update Q&A Profiles.

Password Change and Reset Process Overview

Password Manager uses standard Active Directory methods to reset and change password, applying password policies specified in the Active Directory. Thus resetting or changing password in Password Manager is essentially the same as resetting or changing password using Active Directory Users and Computers (ADUC).

Resetting and Changing Password in Connected Systems

If you have configured Password Manager to use One Identity Quick Connect Sync Engine to reset and change passwords in multiple systems, Password Manager will at first reset or change password in the managed domain. If this operation is performed successfully, then the password will be reset in all connected systems, otherwise Password Manager will attempt to reset the password in the systems in which the password can be reset independently from Active Directory, and all other systems will be skipped.