« Back to Using Liferay

Password Reminders

Introduction #

Currently, for users that forget their passwords, Liferay Portal allows obtaining a new one by email. This functionality will allow a second security mechanism based on reminder queries. When this functionality is enabled, in order to request a new password the user will go to the existing UI called "Forgot Password" to introduce his email address / login and a text verification. After that, the user will be shown a new page which shows him his question and the user will have to provide the answer so that the new password is sent to his email address. This new mechanism requires users to select a query out of a list of queries provided or write their custom question and giving a textual answer. To that end the form shown for My Account has been extended to allow the end user to provide an answer to it.

How does it work? #

If reminder queries are enabled when a new user logs into the portal for the first time he will be shown a page which makes him choose a question and an answer.

In this situation, a new password won't be sent to any user unless he remembers his answer to the question. If a user doesn't have a stored answer, he won't be able to recover a new password.

After the first login, reminder query and answer can be modified through My account.

We can allow users to have their own questions or make them choose one from a list.

When a user has to choose a reminder query question, the list of available reminder queries will be obtained by: 1. Looking at an specific set of reminder queries specifically for his immediate organization. 2. If his immediate organization doesn't have a set of reminder queries, repeat the lookup for the parent organization. 3. Repeat until a parent organization has a set of reminder queries or the top level is reached. When this happens the list is obtained from portal.properties 4. If the user belongs to several organizations the same process is repeated for each and the reminder queries found will be added to the available options.

Configuration #

This mechanism can be configured through several properties in portal.properties.

#

  1. Settings for reminder queries

users.reminder.queries.enabled=true users.reminder.queries.custom.question.enabled=true }}} The first property enables the mechanism of reminder queries and makes them essential to obtain a new password. The second property allows the user to write his own question so that he can choose his own one in addition to the ones offered to him by default.

#

  1. Input a list of valid reminder queries

users.reminder.queries.questions=what-is-your-primary-frequent-flyer-number, what-is-your-library-card-number,what-was-your-first-phone-number,what-was-your-first-teachers-name, what-is-your-fathers-middle-name }}} This property allows us to write the pre-set reminder queries. (By default, they are the same used by Google). It is important to separate them by commas, no capital letters and hyphens between words. Writing them in this format allows Liferay to show them in different languages to users.

In addition, any organization can define its own reminder queries instead of the default ones. This can be done in a new section in Control panel --> Organizations --> Reminder queries.

4 Attachments
45822 Views
Average (0 Votes)
The average rating is 0.0 stars out of 5.
Comments
Threaded Replies Author Date
Nice. Is this available in 5.1.2 or 5.2? Joshua Asbury October 22, 2008 6:09 AM
5.2 Julio Camarero October 30, 2008 9:24 AM
Hi Julio, Could you please tell me where to add... Nicolas G. April 9, 2009 9:41 AM
Hi Julio, Could you please tell me where to add... Nicolas G. April 9, 2009 9:41 AM
This is a great article. However, I observed a... Preeti Pabreja April 28, 2011 1:21 PM
Reminder questions and answers are not... Archi Madhu November 2, 2011 5:40 AM
Thanks, It helped me lot. Esteban Gomez January 23, 2015 1:26 PM

Nice. Is this available in 5.1.2 or 5.2?
Posted on 10/22/08 6:09 AM.
Posted on 10/30/08 9:24 AM in reply to Josh Asbury.
Hi Julio,
Could you please tell me where to add other translation of the pre-set reminder queries defined for the main organization.
thx regards,
Nico
Posted on 4/9/09 9:41 AM.
Hi Julio,
Could you please tell me where to add other translation of the pre-set reminder queries defined for the main organization.
thx regards,
Nico
Posted on 4/9/09 9:41 AM.
This is a great article. However, I observed a bug in 6.0.5 CE:
My observation is that the reminder queries for the default language (English) are not getting saved. Reminder queries for other languages are saved and show up when a new User in that Org logs in the 1st time.
Posted on 4/28/11 1:21 PM.
Reminder questions and answers are not encrypted. Anyone can look fire DB query and reset my password!emoticon
Posted on 11/2/11 5:40 AM.
Thanks, It helped me lot.
Posted on 1/23/15 1:26 PM.