topic Re: Can Users reset passwords for ArcGIS built in security at 10.1? in ArcGIS Enterprise Questions

Can Users reset passwords for ArcGIS built in security?

AndrewDuff — Thu, 19 Jul 2012 18:44:13 GMT

AT 10.0 there was a web page included along with ArcGIS server that would allow a user to to reset his account in the SQL Server user store. Does anything like that exist for 10.0? How can I allow my users to change their passwords?

Thx

Re: Can Users reset passwords for ArcGIS built in security at 10.1?

AndrewDuff — Fri, 27 Jul 2012 22:49:44 GMT

AT 10.0 there was a web page included along with ArcGIS server that would allow a user to to reset his account in the SQL Server user store. Does anything like that exist for 10.0? How can I allow my users to change their passwords?

Thx

Can anyone help me out here?

Re: Can Users reset passwords for ArcGIS built in security?

IsmaelChivite — Sat, 28 Jul 2012 05:20:44 GMT

Hi,

to change the password of an existing user in the built-in store, you will need to provide credentials for an ArcGIS Server Administrator. You can invoke the http://server:port/arcgis/admin/security/users/update end point of the ArcGIS Server Administration REST API.

at this point, there is not an out of the box page where users can go and change their passwords, although the end point above can be invoked from any scripting language. Typically, you would write a simple page from which users can first provide their existing password (to verify that they are the user claim to be), and then pass their new password into a PHP, Java or ASP.Net etc page that would actually connect to the ArcGIS Server with Admin credentials and make the change on behalf of the user.

Ismael

Re: Can Users reset passwords for ArcGIS built in security?

Anonymous User — Wed, 26 Sep 2012 17:30:40 GMT

How can I verify that the user entered their old password correctly, before I use the administrator account to reset their password?

Re: Can Users reset passwords for ArcGIS built in security?

Anonymous User — Wed, 10 Oct 2012 21:02:03 GMT

After communication with Esri Support in Redlands, they created a new documentation bug
#NIM085420 ArcGIS Server Administrator API for 10.1 help document states that there is an operation to change the password for a user account but none exists.

As for a workaround, the one that Ismael suggested above is how it can be done for builtin user stores. For other types of user stores, just directly make your code work the user stores' API.

Re: Can Users reset passwords for ArcGIS built in security?

AndrewDuff — Mon, 19 Nov 2012 19:53:53 GMT

Hi,

At this point, there is not an out of the box page where users can go and change their passwords, although the end point above can be invoked from any scripting language. Typically, you would write a simple page from which users can first provide their existing password (to verify that they are the user claim to be), and then pass their new password into a PHP, Java or ASP.Net etc page that would actually connect to the ArcGIS Server with Admin credentials and make the change on behalf of the user.

Ismael

Thank you for the response Ismael. This would be an excellent sample script for using the Rest Admin API such as this one for uploading user accounts - http://resources.arcgis.com/en/help/main/10.1/#/Example_Create_users_and_roles_from_a_CSV_file/0154000005z1000000/. I know this is probably pretty simple but I haven't done anything like this before. Do you have any pointers to help me get started?

Thanks,

Andy

Re: Can Users reset passwords for ArcGIS built in security?

AndrewDuff — Fri, 17 Jan 2014 15:44:13 GMT

bumping this old thread, hoping that ESRI has a sample for this?

Re: Can Users reset passwords for ArcGIS built in security?

AndrewDuff — Wed, 21 Jan 2015 17:43:10 GMT

Hi Ismael,

We are finally starting a development effort to build this tool. We are looking at ways to ensure the user is who they say they are before allowing updates to user credentials. The getUsers and Search functions do not return the users passwords (as far as we can tell). Is there a simple admin call that we could use to verify the user who they say they are before making a call to modify the store (before we update a password for example)? Thanks, Andy