Properties

File location

The file containing the properties is called pwdreset.json and is located in <installation path>\pwdreset\config\modules, where the installation path depends on the operating system and installation setup.

Configuration

Properties

Name	Description	Default value	Mandatory
name	Must be set to PasswordReset	PasswordReset
http_port	Port	8080
http_context	The context under which the application is served.	/pwdreset
webroot_dir	Where to load web resources from.	web
http_auth_redirect_url	Where to send the user for authentication.	/pwdreset/authn/login
logout_endpoint_url	Sets the post-logout destination for Password Reset. When the application runs behind AuthN, this value takes precedence over the AuthN SAMLSP logout_location. Click link for more info.	/pwdreset/logged_out/
overlay_dir	Where to load the overlaid resources from.	N/A
pipe_id	Pipe to execute.	N/A
rules	Legacy flat rule array. Must not be combined with rule_policies. If neither is configured, the built-in policy applies.	Built-in policy
rule_policies	Array containing named password rule policies. The active policy is selected from the session parameter password_policy. Exactly one policy must have default: true. An explicitly empty array is invalid.	Not configured

Example

{
  "name" : "PasswordReset",
  "config" : {
    "http_listener" : "default",
    "pipe_id" : "pwdreset",
    "overlay_dir" : "${system.customer_home}/overlay/",
    "logout_endpoint_url" : "${globals.logout_endpoint_url}",
    "rule_policies" : "@include:rules/rules.json"
  }
}

Policy defaults and validation

Configure either rule_policies or legacy rules, never both. Each named policy needs a non-empty unique id and a rules array; exactly one must be marked default: true. A missing, empty, or unknown session password_policy selects that default.

If neither setting is present, the built-in policy requires at least 8 characters, fewer than 128 characters, uppercase, lowercase, special character, number, confirmation, and a breach check. An explicitly configured rule array replaces the built-in list; it does not add to it. Values such as 10 in UI examples are not fixed application requirements.

The optional logout_url controls the logout action returned to the browser (by default the authentication login location followed by logout). logout_endpoint_url controls the destination after AuthN terminates the session; it is not a substitute for the logout action. Optional user_info_session_values lists extra session fields returned in user_info for UI interpolation; it does not add those fields to the reset pipe request automatically.