Self-Service Password Management for Employees

Transcription

1 Self-Service Password Management for Employees Version 1 Last updated: September 7, 2010 Department of Division of Information Technology Lehman CUNY

2 Prepared by Safiul Roni, Department of Comments about this document should be directed to IT Help Desk Information Technology Center Carman Hall, Room 108 (718)

3 Introduction Self Service Password Management (SSPM), available since June 25, 2010, allows staff and faculty to manage the passwords associated with their Lehman LDAP accounts. Your LDAP account consists of a username and password. The username is usually composed of your first name, followed by a period, followed by your last name (e.g. john.doe). Your LDAP account provides access to Lehman IT services including Mirapoint , the campus wireless network, Library database access from off-campus, the VPN, the Lehman Print/Copy Management System and Webgrade. Your Lehman LDAP account is distinct from various CUNY-wide accounts such as RACF (used mainly for SIMS access), the CUNY Portal (used mainly for Blackboard) and CUNY First. SSPM is a web-based application accessible from on- or off-campus at the following address: The following web browsers are supported for this application: Internet Explorer 8 or above for Windows (not in compatibility mode) Firefox 3.6 or above for Windows or the Apple Macintosh Safari 4 or above for the Apple Macintosh Chrome 4 or above for Windows or the Apple Macintosh You can also change your LDAP password through the Change Password option available in Mirapoint Webmail. However, because of the additional functionality of SSPM including the ability to reset forgotten passwords and to determine the expiration and locked status of an account, we strongly encourage you to manage your LDAP account through SSPM. Overview Your first step in using SSPM is to register your LDAP account by selecting the Register Account function from the opening menu. You will be required to change your password during the registration process. The Register Account function requires that you know the current password for your account. If you do not remember your current LDAP password, please contact the IT Center Help Desk located in the IT Center, Room 108, Carman Hall, and reachable by telephone at and by at helpdesk@lehman.cuny.edu. Once your initial password is reset by the Help Desk, you can then proceed to register the account on SSPM and change the password. 3

4 Once registered, two additional functions allow you to manage your password. Two of the functions, Reset Password and Change Password, are only available for a registered account. During the registration process you provide answers to four secret questions. To reset a forgotten password, you are asked to provide your original answers to two questions randomly selected from the four. The Change Password function requires that you know the current password for your account. If you do not remember your current LDAP password and are unable to use the Reset Password option, contact the Help Desk. Once your initial password is reset by the Help Desk, you can then re-register the account on SSPM and change the password. A fourth function, Test Your Account, can be used at any time to test your username and password. If they are entered correctly, SSPM will display the expiration date of your password. It will also display a message if your LDAP account is locked due to an excessive number of failed login attempts. Password Policy LDAP passwords are now subject to policies that conform to City University of New York and New York State security guidelines, and industry best practices. In particular, following CUNY security guidelines, LDAP passwords will expire after 90 days. Consequently, a password of an LDAP account existing on June 25, 2010 when SSPM went into operation was set to expire on or about September 23 (90 days after June 25) unless the password was changed before that date. Resetting the password resets the expiration to 90 days after the date of the password change. You will receive daily reminders that your LDAP password will expire beginning ten days prior to the expiration date. Passwords should not be easy to guess. New passwords must contain: at least eight characters at least one numeric character at least one upper case letter at least one lower case letter In other words, there must be at least one numeric and two alphabetic (one upper case, one lower case) characters in the password. If you attempt to change your LDAP password through the Change Password function in Mirapoint Webmail Options, you will receive the following message if your new password does not conform to these rules: Change Password: Ldap Error: Constraint violation 4

5 Accounts will be locked for one hour if a password is repeatedly mistyped. You will only know if a password has expired or is locked by checking SSPM. The services that authenticate against LDAP (e.g. Mirapoint , VPN, campus wireless network access) display the same standard message for a failed login regardless of the cause; the same message is displayed if a password or username is mistyped, or if the account has expired or is locked. The Test Your Account function of SSPM can help you determine the status of your account. Using SSPM To use SSPM, open up a browser: Go to The following screen will appear: Registering Your Lehman /LDAP Account 1. Click on the Register Account button. 2. The following screen will appear: 5

6 3. Enter your LDAP user name, (e.g. john.doe). 4. Enter your current LDAP password. 5. Enter a new password, which will become your LDAP and Lehman passwords upon successful completion of the registration process. 6. Type your new password again where it says Confirm New Password. 7. Select four questions and enter the answers in the box directly below it. 8. Click the Submit button. The answers to all four chosen questions must be unique. Your new password has to have at least eight characters, and must contain at least one upper case letter, one lower case letter, and one number. 6

7 Once you have successfully registered your Lehman account, you will receive the following message: Resetting Your /LDAP Account Password In order to use the Reset Password function to reset your account password you must answer the required questions successfully. 1. Click on the Reset Password button. 2. The following screen will appear: 3. Enter your Lehman LDAP user name. ((The username system.monitor6 is used for illustrative purposes in the following screens.) 4. Click the Submit button. 5. The following screen will appear with two of your questions displayed. 7

8 6. Answer the questions and then click the Submit button. 7. The screen below will appear. 8

9 8. Enter a new password. 9. Retype the new password where it says Confirm New Password. 10. Click the Submit button. 11. You will receive the following message: Your new password has to have at least eight characters, and must contain at least one upper case letter, one lower case letter, and one number. Changing Your Password To use the SSPM Change Password function to change your password you need to know your current password. 1. Click on the Change Password button. 2. The following screen will appear: 9

10 3. Enter your Lehman LDAP user name. 4. Enter your current Lehman LDAP account password. 5. Enter a new password, confirm it, and then click the Submit button. Your new password has to have at least eight characters, and must contain at least one upper case letter, one lower case letter, and one number. Test Your Account You may test your account after you have reset or changed your password. 1. Click on the Change Password button 2. The following screen will appear: 10

11 3. Enter your Lehman LDAP user name. 4. Enter your current Lehman LDAP account password and then click the Submit button. 5. You will receive the following message. Student LDAP and accounts Students also receive a Lehman LDAP account providing access to the Print/Copy Management System, the campus wireless network, remote Library database access from off-campus and other IT services. However they do not receive Mirapoint 11

12 accounts. Student , known as Lehman, is hosted by Microsoft and uses a separate username and password. Consequently, prior to SSPM, students have been unable to change their LDAP passwords because they lacked access to Mirapoint. SSPM now allows students to manage the passwords associated with their Lehman LDAP accounts and Lehman accounts and to keep the passwords for both systems the same (synchronized). A separate document on SSPM has been prepared for students: Self-Service Password Management for Students. Please contact the IT Center Help Desk if you have any questions or concerns about use of the SSPM system or about the new password policies (by telephone at , by at help.desk@lehman.cuny.edu, or in-person at Carman Hall room 108). 12