Password Reset
1Kosmos gives Community Administrators control over how end users reset forgotten passwords.
Overview
The configuration lives under Authentication > Reset Password in AdminX, where you can enable one or more reset methods depending on your organization's security requirements.
Methods to Reset a Password
Reset via AdminX — sends a reset link by email, or a link combined with a passcode to the user's registered phone
Reset via Mobile App — allows users to reset directly from the 1Kosmos mobile app; must be explicitly enabled even if mobile resets were previously working
Reset via Identity Verification — users verify their identity using a government-issued document before resetting.
You also choose the identifier users enter on the Forgot Password screen — either their email address or username. If username is selected, the reset link is sent to the email address associated with that account.
Once configured, click Save.
Resetting via AdminX
When AdminX-based reset is enabled, users click Forgot Password? on the login screen and enter their email or username. From there, the flow depends on the method configured:
Email link only — user receives a reset link, clicks it, and sets a new password
Email link + passcode — user receives the link and also a passcode on their registered phone; both must be used to complete the reset
Event Logs — E_PWDRESET_SUCCEEDED and E_PWDRESET_FAILED are triggered on completion or failure.
Identity Verification-Based Reset (SSPR)
The self-service password reset (SSPR) feature lets users verify their identity using a valid identity document before resetting their password, no admin intervention needed.
To enable it, turn on Enable users to reset password through Identity Verification under Authentication > Reset Password > Reset Password Configurations.
How It Works
The user clicks Forgot Password, enters their email, selects how they want to receive the verification link, and completes a document scan + selfie. Once identity is verified, they're taken directly to the password reset screen.
The password must be reset within 3 minutes of identity verification. After that, the token expires and the process must be restarted.
Name Alias Matching
Community Administrators can configure name aliases to handle common name variations during document matching, for example, mapping "Joe" to "Joseph" or "Mike" to "Michael". These are defined as a dictionary in the SSPR settings.
Workday Integration
If your organization uses Workday as the user attribute source, configure the following before enabling SSPR:
An Active Directory (AD) to 1Kosmos connection is required
Map Workday attributes to one of:
$employeeId,$username, or$emailWrite a transformation script to convert the Workday API response into 1Kosmos session attributes (first name, last name, DOB)
Enable the Workday option in SSPR settings; otherwise the system defaults to your preferred user store (e.g. AD)
The Workday configuration screen accepts the API URL, authorization type (Basic Auth, Bearer Token, or No Auth), and a script editor where you can write and test your transformation logic before saving.
SSPR Event Logs
The E_IDV_DOCUMENT_VALIDATE event is enhanced with fuzzy match scores and a session summary certificate. Both E_PWDRESET_SUCCEEDED and E_PWDRESET_FAILED include a mode field indicating how the reset was attempted: email_link, email_link_with_otp, id_proofing, Authenticator, or Other. For id_proofing mode, the session ID is also included.
Common failure scenarios and their error messages:
Generic password change failure
Generic error: Error while changing user password
Password login not allowed
Your organization does not allow you to login with a password
ID proofing not configured
DVCID not configured in SSPR settings
ID proofing session expired
ID Proofing session is expired
Document verification failed
Document verification failed
User disabled or inactive
User is disabled / User is inactive
Missing required attribute
employeeId / username / email is missing in the user object
Transformation script failure
Transformation script failed
Enforcing Password History
1Kosmos supports password history enforcement during resets across all methods, mobile, AdminX, and identity verification. When enabled, users cannot reuse recently used passwords.
Enable it via Authentication > Reset Password > Password Reset Settings > Enforce Password History Check in AdminX.
Configuring Password History in Active Directory
In Group Policy Management, navigate to: Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy
Set Enforce password history to the number of previous passwords to remember, and ensure Minimum password age is greater than 0. Run gpupdate /force to apply.
When a user tries to reuse a previous password during reset, they'll see:
Last updated
Was this helpful?