Sun Idm Secondary Authentication Policy Options

Question

Hi,
I need some inputs on the below,
1. We have a situation where we need to configure 10 security questions in the policy.
2. Force the user to select minimum 5 questions during their first login.
3. Later on, whenever the user's tries to access password reset from Forgot password - they need to answer only 2 questions in order to reset their password.
The "Default Identity Manager Account Policy" policy has a security questions section to setup the questions. And there is an option to enter "Minimum Number of Questions User is Required to Answer " -
if i configure it as 5, it would work on the initial setup page, but when comes to password reset, it asks for 5 questions answered. Any inputs on this is highly appreciated.
Thanks,
Navatha

Answer 1

Navatha,
To force user to select minimum of 5 questions and allow user to login by answering any 2 of them you can follow these steps:
1) Default Identity Manager Account Policy can be modified by adding following entries in 'Secondary Authentication Policy Options ' section:
a) For Login interface: select 'User Interface' from the drop down.
b) Tick 'Enforce Answer policy at login'
c) slect Any from Authentication Question policy drop down.
d) Enter 2 as the minimum number of questions to be answered.
e) add all the quetions need to answered.
Now since i dont recommend the out of box 'Login Change User Answers Form' form modification, so copy the content in another form. Lets name it as 'Modified Login Change User Answers Form'. Modify the text in 'questionPrompt' label.
            <eq>
              <ref>waveset.loginInterfaces[<ref>selectedLoginInterface</ref>].questionPolicy</ref>
              <s>Any</s>
            </eq>
            <message name='UI_AUTH_QUESTION_PROMPT_2'>
              <i>5</i>  ---->  This has been hardcode. Original value would be two as per your configuration.
            </message>Also Add validation in the form button at bootom:
<block>
  <set name='questions'>
    <null/>
  </set>
  <cond>
    <neq>
      <length>
        <ref>waveset.questions[loginInterface=UI_LOGIN_CONFIG_DISPLAY_NAME_USER_INTERFACE]</ref>
      </length>
      <i>0</i>
    </neq>
    <dolist name='nmr'>
      <ref>waveset.questions[loginInterface=UI_LOGIN_CONFIG_DISPLAY_NAME_USER_INTERFACE].name</ref>
      <cond>
        <notnull>
          <ref><expand>
  <concat>
    <s>waveset.questions[</s>
    <ref>nmr</ref>
    <s>].answer</s>
  </concat>
</expand></ref>
        </notnull>
        <set name='questions'>
          <add>
            <ref>questions</ref>
            <i>1</i>
          </add>
        </set>
      </cond>
    </dolist>
  </cond>
  <cond>
    <lt>
      <ref>questions</ref>
      <i>5</i>
    </lt>
    <s>please answer all five questions</s>  ---> Custom message to be displayed.
  </cond>
</block>Import the form and change the form mapping of 'loginChangeAnswers' with 'Modified Login Change User Answers Form'.
I guess this matches your requirement.