PWM (Forgotten Password Module)

[jtmiller30]

I have setup PWM (v1.7.1) running on Windows 2012. I have everything almost configured and I am getting an error setting up the Forgotten Password Module. When I click on the forgotten password module this is the error Im getting. (The username is not valid or does not have a configured response { 5006 ERROR_RESPONSES_NORESPONSES (multiple user matches found) }) I have it connected to my LDAP server and I am able to search for my users if I want to change their password. I appreciate any help I can get to resolve this matter. I do not have an sql setup on this.

[jtmiller30]

Here is a copy of my pwmconfiguration.xml code

<?xml version="1.0" encoding="UTF-8"?>

AD $2a$10$uhS2ycmTgfln9vGj4asYZ.MYJ6tEZ1J30QyQbxWWC9so0jGgWiBGi true 62 EDDFADE96461791D4C0D0E249DB276D8 Site URL Enable Version Checking Enable Anonymous Statistics Publishing Site Description Forward URL Logout URL Instance Name Idle Timeout Seconds Hide Configuration Health Warnings Known Locales Interface Theme Show Auto Generate Randoms Show Strength Meter Password Guide Text Show Show/Hide Password Button Show Cancel Button Show Reset Button Show Success Pages Show Password Event History Show User Account Information Show Login Page Options Show Logout Button Show Home Button Show Idle Timeout Counter Custom CSS Stylesheet Location Custom Mobile CSS Stylesheet Location Embedded CSS Stylesheet Embedded Mobile CSS Stylesheet Embedded JavaScript Custom Logo Image Change Password Query Match Logout After Password Change Change Password Required Values Form Require Current Password during change Password Change Agreement Message Password Change Minimum Wait Time Password Change Maximum Wait Time Password Pre-Expire Time Password ExpireWarn Time Check Expire During Authentication Seedlist File Post Password Change Actions LDAP URLs LDAP Certificates LDAP Promiscuous SSL true LDAP Proxy User LDAP Proxy Password Pd+Ggyyolib2Xo19IVe91g== LDAP Contextless Login Roots User Selectable Login Contexts LDAP Test User Administrator Query String Username Search Filter Read Password Policies Auto Add Object Classes Last Password Update Attribute LDAP Naming Attribute LDAP Idle Timeout LDAP GUID Attribute Auto-Add GUID Value LDAP Chai Settings Attribute to use for Username Follow LDAP Referrals User Object Class SMTP Email Server Address SMTP Email Server Username SMTP Email Server Password User Email Attribute Maximum Email Queue Age Admin Alert To Address Admin Alert From Address Change Password Email {"from":"Change Password Notice \u003cnoreply@pwm@cmsd.local\u003e","subject":"Password Change Notification","bodyPlain":"You have changed your password. If you did not initiate a password change please contact your help desk immediately.","bodyHtml":"\u003cb\u003eYou have changed your password.\u003c/b\u003e If you have changed your password, then no action is required. If you did not initiate a password change please contact your help desk."} Helpdesk Change Password Email {"from":"Change Password Notice \u003cnoreply@pwm@cmsd.local\u003e","subject":"Password Change Notification","bodyPlain":"Your password has been changed by the heldesk. You should set a new password immediately. If you did not initiate a password change please contact your helpdesk.","bodyHtml":"\u003cb\u003eYour password has been changed by the helpdesk.\u003c/b\u003e You should set a new password immediately. If you did not initiate a password change please contact your helpdesk."} Update Profile Email New User Email New User Verification Email Activation Email Activation Verification Email Forgotten Password Verification Email Guest Registration Email Guest Registration Update Email Send Password Email Subject SMTP Email Advanced Settings User SMS number attribute Maximum SMS Queue Age SMS Gateway SMS Gateway User SMS Gateway Password HTTP(S) Method SMS Gateway Authentication Method SMS Request Data SMS Data Content Type SMS Data Content Encoding SMS Gateway HTTP Request Headers Maximum SMS Text Length Response Regular Expressions SMS Sender ID SMS Phone Number Format Default SMS Country Code Request ID Characters Request ID Length Challenge Token SMS Text Challenge New Password SMS Text New User Verification SMS Text Activation Token SMS Text Activation SMS Text Use URL Shortener Password Policy Source Minimum Length 8 Maximum Length Maximum Repeat Maximum Sequential Repeat Allow Numeric Characters Allow First Character Numeric Allow Last Character Numeric Maximum Numeric Minimum Numeric Allow Special Characters Allow First Character Special Allow Last Character Special Maximum Special Minimum Special Maximum Alphabetic Minimum Alphabetic Maximum Non-Alphabetic Minimum Non-Alphabetic Maximum Uppercase Minimum Uppercase Maximum Lowercase Minimum Lowercase Minimum Unique Characters Maximum Characters From Previous Password Minimum Lifetime Password is Case Sensitive Enable Wordlist Enforce Microsoft-AD 2003 Password Complexity Required Regular Expression Matches Disallowed Regular Expression Matches Disallowed Values Disallowed Attributes Enable Shared History Shared History Age Minimum Password Strength Password Change Message Password Rule Text Wordlist File Wordlist Case Sensitivity Wordlist Word Size Check Disallow Current Password Security Key whI3RiprqRJmq8U9PT7/PtT66NtjddUZkHejKujhqGmjIDGBrkfV/jDn1nFkkpHlAIUylITg9MX0UTeorRpM90P29D2B4pebh7u2EbKUiv0uPV2ge0HzEvBCkSijrnARq6SDfPV7o/lPZZD//Nob5azVp5Fn9UOrcN/QjdttGGt8xiCKkeh9qi7NWwb3fqKAhqwaW29REuDpTa1Ie0j3qSFgJ8yq7uvMFlaFCeOJwFCzlbhcA7g5G9eO79ga6X2+0Ba2b5hCKulx8i2uryF4/puQgBYNJwLxTVi28IXN2MHlb7E3InfyyrbRkF7AJYeDkk4dASqKKKjabWGypLn6Ex/niwxR3VSjzwIrakHz/xAktSiqLf/nWUF/uJj+zselgrj3Sth8JIZuIGHEFH8gLSikFDlW4+4e1MJMkNY+gtJqMhFPmtXFc5vb/BPh52SsAGLF1Y5HjEM6uSHBw2M0/6774q5QBYRD8h6y4cf3GTcLEgvEq59CbkHdCdbQgeJPA5F3PHm4PgyQKxxBhDcajfnH5FxM6Zvfu14B9Dr/Hhee+Sojdai53uy4Um5yuMehIhkUcrzLhp9l2N64YQjbhJv2Gdi+jT5uWl7r5cngavwAsD06zzAPjrMrpIIi655NDmdHtQTzPgGcqVVcyndUrgqRpxckykdKFvwpVmYGk35pAEELnxHm/aZSLr5l0HmW Intruder User Reset Time Intruder User Maximum Attempts Intruder User Check Time Intruder Address Reset Time Intruder Address Maximum Attempts Intruder Address Check Time Enable Bad Password Simulation reCAPTCHA Public Key reCAPTCHA Private Key Captcha Skip Parameter Value Captcha Skip Cookie Enable Back Button / Multiple Browser-Tab Detection Enable Form Nonce Allow URL Sessions Enable Session Verification Disallowed HTTP Inputs Require HTTPS Force Basic Authentication Use X-Forwarded-For Header Enable Reverse DNS Allow Roaming Source Network Address Required HTTP Headers Permitted IP Network Addresses Page Leave Notice Timeout Show Detailed Error Messages SSO Authentication Header Name Maximum Session Duration Token Storage Method Token Characters Token Length Token Maximum Lifetime Token LDAP attribute name Health Check Frequency Java StdOut Log Level Log4j Configuration File Maximum LocalDB Events Maximum Age LocalDB Events LocalDB Log Level File Log Level User History Attribute User History Maximum Events Enable LDAP Wire Trace Startup Alerts Shutdown Alerts Intruder Alerts Fatal Event Alerts Configuration Modification Alerts Daily Summary Alerts Local Alerts Storage Max Age Syslog Audit Servers Enable Setup Responses Force Response Setup Random Questions Required Questions Minimum Random Required Minimum Random Challenges Required During Setup 3 Show Response Confirmation true Case Insensitive Responses Maximum Characters of Challenge Allowed In Response Allow Duplicate Responses Apply Wordlist Helpdesk Random Questions Helpdesk Required Questions Minimum Helpdesk Random Challenges Required During Setup Save Challenge Query Match Check Responses Query Match Enforce Minimum Password Lifetime Enable Forgotten Password Forgotten Password User Search Form {"name":"sAMAccountName","minimumLength":0,"maximumLength":255,"type":"text","required":true,"confirmationRequired":false,"readonly":false,"unique":false,"labels":{"":"Login Name"},"regexErrors":{"":""},"description":{"":""},"selectOptions":{"":""}} Forgotten Password User Search Filter Response Read Location Response Write Location Response Storage Attribute Allow Unlock Responses Storage Hashing Method Required Attributes Require Responses Token Send Method Forgotten Password Success Action New Password Send Method Enable Forgotten Username Forgotten Username Form Forgotten Username Search Filter Username LDAP Attribute Enable New User Registration Creation Context New User Agreement Message New User Form New User Actions Delete On Creation Failure Random Username Characters Random Username Length Enable New User Email Verification Enable New User SMS Verification New User Password Policy Template New User Minimum Wait Time Enable Guest Registration Creation Context Guest Admin Query String New Guest Form Update Guest Form Write Attributes Administrator DN Attribute Edit Guest By Original Administrator Only Maximum Duration of Account Validity Attribute Used To Store Account Expiration Date Enable User Activation Unlock User During Activation Token Send Method Activate User Agreement Message Activate User Form Activation Search Filter Activation Query Match Activation Actions (Before Password Change) Post-Activation Actions (After Password Change) Enable Update Profile Force Update Profile Update Profile Agreement Message Update Query Match Update Write Actions Update Profile Form Update Check Query Match Show Update Profile Confirmation Enable Shortcuts Shortcut Items Shortcut Headers Enable PeopleSearch PeopleSearch Query Match Search Filter LDAP Search base PeopleSearch Result Form PeopleSearch Detail Form PeopleSearch result limit Use proxy account Enable NMAS Extensions Save NMAS Responses Enable NMAS Responses for Forgotten Password Read User Passwords Read Challenge Sets UserApp Password SOAP Service URL Use Proxy When Password Forgotten Allow Authentication When "Must Change Password On Next Login" Is Set Allow Authentication When Password Expired Enable Helpdesk Module true Helpdesk Query Match Helpdesk Search Filter Helpdesk Search Form {"name":"sAMAccountName","minimumLength":1,"maximumLength":64,"type":"text","required":true,"confirmationRequired":false,"readonly":false,"unique":false,"labels":{"":"sAMAccountName"},"regexErrors":{"":""},"description":{"":""},"selectOptions":{}} Helpdesk Detail Form {"name":"sAMAccountName","minimumLength":0,"maximumLength":255,"type":"text","required":false,"confirmationRequired":false,"readonly":false,"unique":false,"labels":{"":"sAMAccountName"},"regexErrors":{"":""},"description":{"":""},"selectOptions":{"":""}} LDAP Search base Helpdesk search result limit Set Password UI Mode Post Set Password Actions Helpdesk Actor Actions Enable Unlock Enforce User Password Policy Idle Timeout Seconds for Helpdesk Users Clear Responses on Password Set LocalDB Location LocalDB Implementation Class LocalDB Initialization String Database Class Database Connection String Database Username Database Password Database Key Column Type Database Value Column Type External Change Method External Judge Method External Rule Method HTTP Proxy CAS ClearPass URL Enable URL Shortening Service Class Regular Expression for Matching URLs Configuration Parameters for URL Shortening Service Enable External Web Services Allow WebServices Read Answers WebServices Third Party Query String External Web Auth Methods

[jrivard]

The error is self explanatory. Please ask for help on the pwm-general google group.

[jtmiller30]

So do I need to input challenge questions in my xml file or should I just remove the ldap from the response read/write section and just use localdb

[jtmiller30]

So do I need to input challenge questions in my xml file or should I just remove the ldap from the response read/write section and just use localdb

On Fri, Nov 13, 2015 at 10:30 AM, Jason notifications@github.com wrote:

The error is self explanatory. Please ask for help on the pwm-general google group.

— Reply to this email directly or view it on GitHub https://github.com/pwm-project/pwm/issues/9#issuecomment-156480479.

James T. Miller Technology Coordinator Clarksdale Municipal School District