changeBackendPassword (Command)

Scenario: Authentication
Support: full-sdk auth-sdk

The changeBackendPassword command serves to change the user's static Active Directory password with a configured back end of OneSpan Authentication Server. The user must authenticate in OneSpan Authentication Server using local authentication, for this operation to succeed.

If password randomization is enabled in OneSpan Authentication Server, the effective policy used by OneSpan Authentication Server must not apply password proxying for the changeBackendPassword SOAP command. Otherwise, this will lead to a user with a randomized password being able to change the password.

Parameters

Table: changeBackendPassword input parameters
Parameter name	Data type	Description
componentType	String	Required. Specifies the component to which the password change is applied.
user	UserInput	Required. The user input information (see UserInput (Data type)). This specifies the user who changes the password.
credential	CredentialInput	Required. The credential parameters used to authenticate the user.
newStaticPassword	String	Required. The new password to be set for the user.

Table: changeBackendPassword output parameters
Parameter name	Data type	Description
status	CommandStatusResponse	Required. The error stack, if applicable, which indicates that the command has not completed successfully. This also includes the result and status codes returned by the command.
result	ChangeBackendPasswordResult	Optional. The returned information about user and user credentials.

UserInput (Data type)

Table: UserInput (Data type)
Element name	Data type	Description
userID	String	The user ID.
domain	String	Optional. The user domain.

CredentialInput (Data type)

Table: CredentialInput (Data type)
Element name	Data type	Description
staticPassword	String	The current static password of the user.
response	String	The one-time password (OTP) sent by the user to obtain the challenge necessary for changing the back-end password.
serialNumber	String	The serial number of the authenticator used for changing the back-end password.
pin	String	The user's current server PIN.
pinChange	PinChange	The parameters to be used when changing the PIN.
challenge	String	The challenge entered by the user to change the back-end password.
challengeKey	String	The key that is used to refer to the challenge that is generated by OneSpan Authentication Server.
requestHostCode	RequestHostCodeEnumeration	Possible values: No Optional Required The default input value is No.

PinChange (Data type)

Table: PinChange (Data type)
Parameter name	Data type	Description
currentPin	String	Required. The user's current PIN.
newPin	String	Required. The new PIN, to be set by the user.

ChangeBackendPasswordResult (Data type)

Table: ChangeBackendPasswordResult (Data type)
Element name	Data type	Description
user	UserOutput	The returned user information.
credential	CredentialOutput	The returned information about the user credentials.

UserOutput (Data type)

Table: UserOutput (Data type)
Element name	Data type	Description
userID	String	The resolved user ID.
domain	String	The user domain.
orgUnit	String	Optional. The organizational unit of the user.

CredentialOutput (Data type)

Table: CredentialOutput (Data type)
Element name	Data type	Description
serialNumber	String	The serial number of the used authenticator.
hostCode	String	The host code. This is returned only if the corresponding attribute field was specified in the authentication request and the authentication has been successful.
challenge	String	The challenge used by the end user to generate the response.

Example

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
  <soapenv:Header/>
  <soapenv:Body>
    <aut:changeBackendPassword xmlns:aut="http://www.vasco.com/IdentikeyServer/IdentikeyTypes/Authentication">
      <componentType>SOAP-LocalAuth</componentType>
      <user>
        <userID>user_pws</userID>
        <domain>MASTER</domain>
      </user>
      <credential>
        <staticPassword>Test1234</staticPassword>
      </credential>
      <newStaticPassword>newPass1</newStaticPassword>
    </aut:changeBackendPassword>
  </soapenv:Body>
</soapenv:Envelope>

Additional considerations

If you use this command to update the static password of a user account and the Invalidate Sessions on Password Change option and the Password Autolearn policy are both enabled, any interactive administrative session of that user account that is currently active is expired.