User password reset options

You can configure Finalsite to allow users to reset their own passwords. Depending on whether the user's password is stored in Finalsite or in an integrated third-party database, the procedure may be slightly different.

 

You can check where a user's password is stored in Constituent Manager > Settings > Constituent Roles > [role] > General Settings tab. Check the “Authorization” dropdown menu to see which system holds the passwords for members of that role.

Note that some users may belong to multiple roles, and the passwords for those roles might be stored in different systems, which would affect how their passwords are reset. See “Multi-Role Users,” below.

 

Finalsite-only Users

 

Whenever site users forgot their passwords they could click the “Forgot Password?” link on the login page. This sends the user an email with a password-reset link in it; that link takes the user to a page where they can type in a new password. 

 

A couple of items to note about the password reset feature:

 

  • Password reset emails will be sent to a user's Primary email address (as defined in their Constituent Manager profile)

  • The links users click to reset their email are time-sensitive, and will expire after 24 hours. If the user hasn't clicked the link and reset their password within 60 minutes, they'll have to click "Forgot password?" again to generate a new email with a new link.

  • If multiple users share one email address, then the email that's generated will contain password reset links for all of the users associated with that email address. This means that one user would be able to reset passwords for another user, provided they share the same Primary email address. (Note that this would represent a security threat if two users who are not members of the same household share an email address!)

  • If a user is both a Site Admin and a portal user (and those accounts are linked), then resetting their portal account password will also reset their Site Admin password, and vice-versa. This will happen even if the portal account is set to a role that is not allowed to self-update passwords.

  • A Site Admin must explicitly identify which roles are allowed to reset their own passwords. This is done in Constituent Manager > Settings > Constituent Roles > [role] > General Settings.

 

Integrated Database Users

Users whose passwords are stored in integrated databases can't use the Finalsite password-reset tool. Instead, they have to use the password-reset functionality built into the school's database system. Site admins should put a custom note on the login page explaining how to do this, and/or a message in the “Forgot Password?” email.

The login page can be specified. In Page Manager. It's located at the bottom of the list of Main Site Pages, under User Login > Member Login.

In Composer, this page can be set by clicking "Settings" on the "Main Site" ("Domain") flyout menu, exactly the same way that role landing pages are configured.

Site Admins can add a custom message to the “Forgot Password” email in the Integrated Services Manager. Go to the “Authentication” tab and select the appropriate database. Use the “Custom Forgot Password Message” field to add custom instructions, or a link to the proper password-reset page.

 

Multi-Role Users

If a single user is assigned to more than one role and at least one of those roles is authenticated against an integrated database, they fall under the category of “Integrated Database Users.” If the passwords for all of their roles are stored in Finalsite, then they will receive password-reset emails as described in Finalsite-Only Users, above.

Was this article helpful?
0 out of 1 found this helpful
Have more questions? Submit a request

Comments

0 comments

Please Sign in to leave a comment if you don't see the comment box below.