Password Validation

0
Hi Guys, I want to set a generic password for all the users on my system,this password need be used a master password should the user forget their password,it has to work with all the users on the system......please bare in mind im a newbie in mendix,how does one do this in a microflow?
asked
2 answers
1

You can assign a password to a user in a microflow. Retrieve user: change object, select attribute.

However, this is not the recommended way to work with passwords. A better approach can be:

  1. Store the email adress of the user.
  2. Give the user an option: 'forgot password'
  3. Send a mail to user with a deeplink and a unique long code
  4. Give the user a reasonable time to use this link (somewhere between 30 minutes and some hours)
  5. Upon clicking this link show an anonymous form to change the password.

Advantages:

  1. System administrator does not know the passwords
  2. End user is responsible

Disadvantage

  1. Depends on mail.
answered
1

Using one generic password is definitely not a good idea. I fully agree on Chris' solution, though you could consider another solution which might be easier to implement (no deeplinks).

  1. Allow anonymous users within your application
  2. Give the option of 'forgot password'.
  3. When clicking, have the user enter the email address and send an email with a "RandomStrongPassword" included (function available in Community Commons Module in Appstore) and reset the User's password with this "RandomStrongPassword".
  4. Create a boolian "ForcePasswordChange" for the user object and set this to 'true'.
  5. Create functionality that when logging in and ForcePasswordChenge = true, the user must mandatory reset his/her password.

Again, doing it with deeplinks is more secure. This is another option should you be unable to get the deeplinks to work (being a newbie and all) :)

Good luck!

answered