Manual password reset
Jive offers two options for admins to reset user passwords when users can't do that themselves. Administrators can set a temporary password (and relay the password to the affected user) or reset the password (for the user to change it on the next login).
Note that you can select only one of these options for your community.
Configuration of the manual password reset affects only the administrator's capabilities for updating user passwords, it does not affect the ability of the users to reset the passwords themselves. For more information on configuring the password options for users including self-service password resetting, see Configuring password update settings.
For the detailed procedure of configuring manual password reset, see Configuring manual password reset.
When password reset is disabled
By default, a community administrator can directly set (for new user accounts) or change passwords (for existing user accounts). In this case, users rely on administrators to correctly pass the password and not abuse the privilege.
The update is done as follows:
- The administrator finds and opens the User Summary page in the Admin Console, then clicks Change Password.
- This opens the Change User Password page where the administrator enters a new password for the user.
- After the change, the administrator informs the user about the password update and relays the new password.
Figure: User properties page with password update option enabled
Figure: Changing password page
Similarly, when creating a new user account, the administrator directly enters the password and relays it to the user later.
When password reset is enabled
With the password reset feature enabled, the administrators can only reset passwords for existing user accounts, thus forcing the users to change the password on the next login. This option provides a more secure way of setting up and updating user passwords.
When a new account is created, the new user is sent an email with the account details: they should click the Forgot Password link and follow the instructions to create a new password for themselves. The email also includes a secure token which is used instead of the password.
The reset is done as follows:
- The administrator finds and opens the User Summary page in the Admin Console, then clicks Reset Password and confirms the reset. The user password expires immediately.
- An email about the password reset is sent to the user. If the user tries to log in before changing the password, they get a message about the password reset. The instructions for updating the password are provided within the communication, including the token.
Figure: User properties page with password reset option enabled
Figure: User login page after a password reset
Logging password updates and resets
Password updates or resets are not explicitly logged. But each password reset revokes all user sessions and such events are logged, for example:
2019-01-02 11:08:37,956/PST - [INFO] - ALL SESSIONS REVOKED for User: 'user@test.com' - [SYSTEM] -