Configuration

To use on behalf of, Password Reset needs information about which users the authenticated user is allowed to reset passwords for, and the reset flow needs to handle that delegated scenario.

How to activate

Add on behalf of attributes to the SAML assertion. Password Reset then uses those attributes to determine whether the password reset should be performed for the authenticated user or for another user.

Required data

To allow resetting a password on behalf of someone else, the incoming assertion needs to include two attributes:

• on_behalf_of_user_name
• on_behalf_of_display_name

In addition, on_behalf_of_email can be included for notification purposes.

These attributes are typically used to present a list of users that the authenticated user is allowed to manage, for example students assigned to a teacher.

Resetting a password on behalf of someone else

Resetting a password on behalf of someone else is handled through pipe logic.

In practice, the pipe inspects the incoming request. If it contains on_behalf_of_user_name, the regular self-service reset flow should be bypassed and a dedicated on behalf of pipe should be used instead.

This makes it possible to keep the regular reset flow for end users while applying separate logic when, for example, a teacher resets a student's password or a service desk agent resets a user's password.