IdM Anonymous user sessions for password resets

Question

I am currently working on an update to a self service password reset customization through the IdM anonymous user interface. I am having issues with SIM not closing the anonymous sessions, once a user attempts an anonymous reset. Anytime one of the idm/user/anon****.jsp pages are accessed SIM logs in as the "Reset" user, so then any user that tries to go back to update their challenge questions, gets "...view acess denied to subject Reset...", as if SIM doesn't relize they are back in their user session. Question:
1. If I use any anon***.jsp pages for any process/workflow launches, for self service, must I handle the logoff of that anonymous session? Currently it looks like a custom logoff and redirect is working, but I was wondering if this is the preferred way to approach this?

Answer 1

Yes, solved a long time ago but yes, I did find a fix for this. Turns out we had multiple issues but did work through them.
First, make sure the LDAP user is NOT Directory Manager or Admin or ANY other ID used for multiple purposes such as a privileged user that also makes changes via other tools. I created a new user in LDAP only for IDM purposes and give it the permissions needed: uid=idmsync,..... The permissions we gave were in essence the same as Directory manager as IDM is used in our case to manage LDAP as well.
Then add in the listening resource to exclude any changes from the uid=idmsync user.
In the changelog stream then all changes by IDM come down as idmsync. But other changes will come through as directory manager or someone else. But by filtering idmsync changes you prevent an infinite loop. eg. IDM sets LDAP generates change to IDM sets LDAP generates change to IDM... However other user changes will be processed without the infinite looping.
From an efficiency perspective, we also spent time refining the active sync forms. But all worked well by production turnover, which was well over a year ago.