Edit your new profile
Prev | Chapter 6. Self service (LAM Pro) | Next

## Edit your new profile

### Basic settings

On top of the page you see the link to the user login page. Copy this link address and give it to your users.

Below the link you can specify several options.

Table 6.1. General options

Server address | The address of your LDAP server
LDAP suffix | The part of the LDAP tree where LAM should search for users
LDAP user + password | The DN and password which is used to search for users in the LDAP database. It is sufficient if this DN has only read rights. If you leave these fields empty LAM will try to connect anonymously.
LDAP search attribute | Here you can specify if your users can login with user name + password, email + password or other attributes.
HTTP authentication | You can enable HTTP authentication for your users. This way the web server is responsible to authenticate your users. LAM will use the given user name + password for the LDAP login. To setup HTTP authentication in Apache please see this link.
Login attribute label | This is the description for the LDAP search attribute. Set it to something which your users are familiar with.
Login caption | This text is displayed at the login page. You can input HTML, too.
Main page caption | This text is displayed at self service main page where your users change their data. You can input HTML, too.
Page header | This HTML code will be placed on top of all self service pages. E.g. you can use this to place your custom logo. Any HTML code is permitted.
Additional CSS links | Here you can specify additional CSS links to change the layout of the self service pages. This is useful to adapt them to your corporate design. Please enter one link per line.

### Page layout

Here you can specify what input fields your users can see. It is also possible to group several input fields.

Please use the arrow signs to change the order of the fields/groups.

You may also set some fields as read-only for your users. This can be done by clicking on the lock symbol. Read-only fields can be used to show your users additional data on the self service page that must not be changed by themselves (e.g. first/last name).

Possible input fields

This is a list of input fields you may add to the self service page.

Table 6.2. Self service fields
Account type | Option | Description
--- | --- | ---
Asterisk (voicemail) | Sync Asterisk password with Unix password | This is a hidden field. It will update the Asterisk password each time the Unix password is changed.
Kerberos | Sync Kerberos password with Unix password | This is a hidden field. It will update the Kerberos password each time the Unix password is changed.
Kolab | Delegates | Allows to manage delegate permissions
Invitation policy | Invitation policy management
Password self reset | Question | Security question selection
Answer | Security answer
Personal | Business category |
Car license |
Department |
Email address |
Fax number |
First name |
Home telephone number |
Initials |
Job title |
Last name |
Location |
Mobile number |
Office name |
Photo | Shows the user photo if set. The user may also remove the photo or upload a new one.
Postal address |
Postal code |
Post office box |
Registered address |
Room number |
State |
Street |
Telephone number |
User certificates | Upload of user certificates in PEM or DER format
Web site |
Samba 3 | Password | Input field to set a new NT/LM password. The attribute "sambaPwdLastSet" is updated if it existed before.
Sync Samba LM password with Unix password | This is a hidden field. It will update the Samba LM password each time the Unix password is changed.
Sync Samba NT password with Unix password | This is a hidden field. It will update the Samba NT password each time the Unix password is changed.
Update attribute "sambaPwdLastSet" on password change | Updates the password timestamp when password is synchronized with Unix.
Windows | Password | Change the user's password
Location |
Office name |
Postal code |
Post office box |
State |
Street |
Telephone number |
Web site |
Unix | Common name |
Login shell |
Password | This is also the source for several password synchronization options.
Zarafa | "Send as" privileges | Define user who may send mails as this user
Email aliases | Email aliases

### Module settings

This allows to configure some module specific options (e.g. custom scripts or password hash type).

#### Password self reset

Settings

You can allow your users to reset their passwords themselves. This will reduce your administrative costs for cases where users forget their passwords.

To enable this feature please activate the checkbox "Enable password self reset link".

Hint: Plese note that LAM Pro uses security questions by default. Activate confirmation mails and then deactivate security questions if you want to use only email validation.

You can now configure the minimum answer length for password reset answers. This is checked when you allow you users to specify their answers via the self service. Additionally, you can specify the text of the password reset link (default: "Forgot password?"). The link is displayed below the password field on the self service login page.

Next, please enter the DN and password of an LDAP entry that is allowed to reset the passwords. This entry needs write access to the attributes shadowLastChange, pwdAccountLockedTime and userPassword. It also needs read access to uid, mail, passwordSelfResetQuestion and passwordSelfResetAnswer. Please note that LAM Pro saves the password on your server file system. Therefore, it is required to protect your server against unauthorised access.

Please also specify the list of password reset questions that the user can choose.

Please note that self service and LAM admin interface are separated functionalities. You need to specify the list of possible security questions in both self service profile(s) and server profile(s).

You can inform your users via mail about their password change. The mail can include the new password by using the special wildcard "@@newPassword@@". Additionally, you may want to insert other wildcards that are replaced by the corresponding LDAP attributes. E.g. "@@uid@@" will be replaced by the user name.

LAM Pro can send your users an email with a confirmation link to validate their email address. Of course, this should only be used if the email account is independent from the user password (e.g. at external provider). The mail must include the confirmation link by using the special wildcard "@@resetLink@@". Additionally, you may want to insert other wildcards that are replaced by the corresponding LDAP attributes. E.g. "@@uid@@" will be replaced by the user name.

There is also an option to skip the security question at all if email verification is enabled. In this case the password can be reset directly after clicking on the confirmation link. Please handle with care since anybody with access to the user's mail account can reset the password.

Troubleshooting:

If you get messages like "Unable to find user account." this can have multiple reasons:

- security questions enabled but no security question and/or answer set for this user

- user name + email combination does not exist

- no connection to LDAP server

Turn on logging in LAM's main configuration settings. The exact reason is logged on notice level.

New fields for self service page

There are two new fields that you may put on the self service page for your users. These fields allow them to change the reset question and its answer.

This is an example how can be presented to your users on the self service page:

Password reset link

After activating the password self reset feature there will be a new link on the self service login page. The text can be configured as described above (default: "Forgot password?").

When a user clicks on the link then he will be asked for identification with his user name and email address.

LAM Pro will use this information to find the correct LDAP entry of this user. It then displays the user's security question and input fields for his new password. If the answer is correct then the new password will be set. Additionally, pwdAccountLockedTime will be removed and shadowLastChange updated to the current time if existing.

#### User self registration

With LAM Pro your users can create their own accounts if you like. LAM Pro will display an additional link on the self service login page that allows you users to create a new account including email validation.

You enable this feature in your self service profile. Just activate the checkbox "Enable self registration link".

Options:

Link text: This is the label for the link to the self registration. If empty "Register new account" will be used.

Admin DN and password: Please enter the LDAP DN and its password that should be used to create new users. This DN also needs to be able to do LDAP searches by uid in the self service part of your LDAP tree.

Object classes: This is a list of object classes that are used to build the new user accounts. Please enter one object class in each line.

Attributes: This is a list of additional attributes that the user can enter. Please note that user name, password and email address are mandatory anyway and need not be specified.

Each line represents one LDAP attribute. The options are separated by "::". The first option specifies if the attribute is mandatory. It can have the values "optional" and "required". The second option is the LDAP attribute name and the third one is a descriptive label for it. Options four and five are used for input validation. Please enter the regular expression (e.g. "/^[0-9a-zA-Z]+$/") and an error message if the value does not match it. For a syntax description see here. Validation is optional.

Example:

optional::givenName::First name::/^[[:alnum:] ]+$/u::Please enter a valid first name.

required::sn::Last name::/^[[:alnum:] ]+$/u::Please enter a valid last name.

If you use the object class "inetOrgPerson" and do not provide the "cn" attribute then LAM will set it to the user name value.

Please note that only simple input boxes are supported for account registration. The user may log in to self service when his account was created to manage all his attributes.

User view:

The user can register by clicking on a link on the self service login page:

Here he can insert the data that you specified in the self service profile:

LAM will then send him an email with a validation link that is valid for 24 hours. When he clicks on this link then the account will be created in the self service user suffix. The DN will look like this: uid=<user name>,...

#### Custom fields (LAM Pro)

This module allows you to manage LDAP attributes that are not covered by the other LAM modules (e.g. if you use custom LDAP schemas). You can fully define how your input fields look like:

- Label

- LDAP attribute name

- Unique name for field

- Read-only display

- Field type: text, password, text area, checkbox, radio buttons, select list

- Validation via regular expression

- Error message if validation fails

To create custom fields for the Self Service please edit your Self Service profile and switch to tab "Module settings". Here you can add a new field. Simply fill the fields and press on "Add".

Please note that the field name cannot be changed later. It is the unique ID for this field.

After you created your fields please press on "Sync fields with page layout". Now you can switch to tab "Page layout" and add your new fields like any other standard field.

Examples for fields and their representation in Self Service:

Text field:

Text fields allow to specify a validation expression and error message.

Presentation in Self Service:

Password field:

You can also manage custom password fields. LAM Pro will display two fields where the user must enter the same password. You can hash the password if needed.

Presentation in Self Service:

Text area:

This adds a multi-line field. The options are similar to text fields. Additionally, you can set the size with the number of columns and rows.

Please note that the validation expression should be set to multi-line. This is done by adding "m" at the end.

Presentation in Self Service:

Checkbox:

Sometimes you may want to allow only yes/no values for your LDAP attributes. This can be represented by a checkbox. You can specify the values for checked and unchecked. The default value is set if the LDAP attribute has no value.

Presentation in Self Service:

Radio buttons:

This displays a list of radio buttons where the user can select one value.

You can specify a mapping of LDAP attribute values and their display (label) on the Self Service page. To add more mapping fields please press "Add more mapping fields".

Presentation in Self Service:

Select list:

Select lists allow the user to select a value in a large list of options. The definition of the possible values and their display is similar to radio buttons.

You can also allow multiple values.

Presentation in Self Service:

Validation expressions:

The validation expressions follow the standard of Perl regular expressions. They start and end with a "/". The beginning of a line is specified by "^" and the end by "$".

Examples:

/^[a-z0-9]+$/ allows small letters and numbers. The value must not be empty ("+").

/^[a-z0-9]+$/i allows small and capital letters ("i" at the end means ignore case) and numbers. The value must not be empty ("+").

Special characters that must be escaped with "\": "\", ".", "(", ")"

E.g. /^[a-z0-9\.]$/i

Prev | Up | Next
Creating a self service profile | Home | Adapt the self service to your corporate design