Bug: Users Are Prompted to Change Their Password Again Right After Resetting It with Enforce Password Change Requirements

Version Affected: 26.2, 26.3, and 26.4 before 26.4.3.14
Bug Number: EE-4067
Bug Status: Closed - Fixed
Fixed in Version(s): 26.4.3.14 or later

 

Overview

In a password reset realm whose Password Reset Mode is Enforce Password Change Requirements, with Require Current Password set to False, users are prompted to change their password again right after resetting it. The reset succeeds, but the User must change password at next logon flag stays set on the user's Active Directory (AD) account, which triggers inline password change.

 

Cause

This is a known defect (EE-4067), introduced in 26.2. Before 26.2, an Enforce Password Change Requirements reset without the current password first set a random temporary password, then changed it to the user's new password. That second change cleared the User must change password at next logon flag in AD.

From 26.2, the reset sets the new password directly and applies the realm's Must Change Password at Next Logon setting. The Web Admin advises setting Must Change Password at Next Logon to True for this mode, so the flag stays set after the reset.

 

Resolution / Workaround

Upgrade to 26.4.3.14 or later to resolve this issue. From 26.4.3.14, an Enforce Password Change Requirements reset without the current password always clears the User must change password at next logon flag, whatever Must Change Password at Next Logon is set to. The same build corrects the Web Admin's guidance for this mode.

Until you can upgrade, set Must Change Password at Next Logon to False on the password reset realm:

1. In the Web Admin, open the password reset realm's Post Authentication tab.
2. In the Password Reset section, click Configure password reset page.
3. Set Must Change Password at Next Logon to False.
4. Click Save.

After you upgrade to 26.4.3.14 or later, Must Change Password at Next Logon no longer affects Enforce Password Change Requirements resets.


 

Special Considerations

• Help desk and API password resets honor Must Change Password at Next Logon, and the fix does not change that. If your help desk relies on this setting to make users change a password it has reset, take that into account before you set it to False as a workaround, and set it back to True after you upgrade to 26.4.3.14 or later.
• Realms that use a Web Service data store are still affected after the fix, because the web service cannot carry the User must change password at next logon flag.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.