Excluding Seamless Learning Access Users from Forgot Password Policies

RapidIdentity Platform Documentation

Solution

Application

Content Type

Technical Documentation

Utilities & Services

ft:locale

en-US

Seamless Learning Access iPad users do not have access to their RapidIdentity password, as the RapidIdentity session is created automatically by the single sign-on extension.

RapidIdentity is preconfigured with default Forgot Password policies for students, sponsored accounts, and all other users. Users associated with a Forgot Password policy are required to enroll the authentication methods defined by that policy.

You can adjust the default student policy and default baseline policy to exclude Seamless Learning Access users from the authentication method enrollment requirement using this procedure. Two alternative approaches are available but are not recommended:

Disable all default Forgot Password policies: Edit each pre-defined policy and toggle off the Enabled setting. This approach prevents tenant administrators and staff from resetting their own passwords, because the default baseline policy also applies to them.
Disable only the default student policy: Edit the default student policy and toggle off the Enabled setting. This approach leaves Seamless Learning Access users subject to authentication method enrollment from the default baseline policy.

Requirements

Access to your RapidIdentity administrator portal

Navigate to your RapidIdentity administrator portal.
From the module selector, choose "Configuration".
In the Policies section, click Forgot password.
Edit the Default student policy.
1. Next to the Default Student Policy field, click Edit.
2. In the General tab, set the LDAP filter to the following value:
```
(&(employeeType=student)(!(idautoPersonSLAID=*)))
```
3. Click Save.
Edit the Default baseline policy.
1. In the sidebar, click Forgot Password.
2. Click Edit for the Default Baseline Policy field.
3. Set the LDAP filter to the following value:
```
(&(!(employeeType=student))(!(employeeType=sponsored))(!(idautoPersonSLAID=*)))
```
  Important:
  The default baseline policy applies to the tenant administrator. The filter above prevents the tenant administrator from resetting their password if the tenant administrator account has a value in the idautoPersonSLAID attribute. Seamless Learning Access bypasses multi-factor authentication and should not be used by privileged accounts.
  
  To preserve the tenant administrator's ability to reset their password, set the LDAP filter to the following value:
```
(&(!(employeeType=student))(!(employeeType=sponsored))(!(idautoPersonSLAID=*))(!(idautoPersonUserNameMV=tenant_admin_username)))
```
4. Click Save.
Leave the Default sponsored policy unchanged.

Seamless Learning Access users with the idautoPersonSLAID attribute populated are excluded from authentication method enrollment requirements set by the default student policy and default baseline policy. Other students, staff, and administrators can continue to enroll authentication methods as required by their applicable policy.