AuthnMethodPasswordChange

Description of the configuration object

A numeric weight to be assigned to this authentication method. You can create authorization conditions based on these assurance level weights.

The holder for common URL configurations of an authentication method.

Whether or not the authentication service correlates user accounts in the 'User Repository' upon successful validation of provided credentials. SAML assertion based authentication at SPs should consider unchecking depending on the underlying scenario.

Whether or not the authentication service considers validity metadata for example, account lifetime or locking state.

Whether or not the authentication service invokes the server-global subject attribute finder plug-in for this authentication method. This plug-in allows you to look up supplementary information about an authenticated user that is not part of the user account against which authentication was performed and is used when information about a single user is distributed across various repositories.

A value to be imprinted as SAML authentication context class reference when issuing SAML assertions for subjects that have been authenticated with this method. If the value is undefined, a default mapping to SAML-defined values is used.

Whether or not to generate the authentication-method-specific domain name in the format: authentication_id@authentication_method_id.

The domain identifier used for the names retrieved by this authentication method during the domain name resolution.

The domain name format used for the names retrieved by this authentication method during domain name resolution. The format may contain placeholders: #1 (replaced by the authentication identifier), and #2 (replaced by the domain identifier).

Whether or not the authentication identifier is hashed before it is included into the domain name.

To what extent is the user correlation with an existing user record in user repository for this authentication method forced. This element has priority over the Do correlate user accounts element.

Reference to authentication method of the same type to share the credentials and credential-specific configuration with. If null, this method works with its own configuration and set of credentials for each user. For every authentication method the domain name configuration is being resolved which is then used during unique name resolution. Specifics for some methods are:

Indicates whether Just-in-Time (JIT) provisioning of user records to the application repository is enabled. If enabled, a user record is automatically created in the application repository after successful authentication if it does not already exist. If disabled, authentication will not trigger the creation of a new user record if one does not exist.

The type of new password callout propagation. Currently, supported options are:

The option identifies the attribute name of an already authenticated and correlated user with the user repository where the decision that a password change is required can be found. The actual password change is responsibility of the callout handler implementation. If filled it, it is supposed that the referenced authentication method password has 'User_Repository' 'Password Source'.

The value of the previous user repository attribute to be set when the password change is required. If the value is not filled in, it is supposed that the value of the user repository attribute is 'true' or 'false'.

The option identifies the authentication method password configuration object for which the password is supposed to be changed by this method. Application repository user record may contain also a decision that the password needs to be changed. In Application repository user record, the decision, the number of login failures and even the password (if the 'Password Source' is 'Application_Repository') are changed regardless of the password propagation type configuration and the actual callout handler assignment.

If the value is true, the password change is enforced for anyone regardless of any attribute. The method then behaves like a password reset method.

The identifier of the callout handler to propagate new password via back channel or construct request for front channel redirection. It makes sense to choose a callout handler configuration that only processes the "PasswordPropagationEvents".

If true, the old password is required to change the password. Therefore, the password field is displayed along with the new password and new password retype field. If true, the old password is verified based on referenced password authentication method.