Auth - Forgot Password

A 2 stage process to reset a user's password:

• Firstly, when only the username is specified, an email is sent to the specified user's registered email account. This email contains a link to the "forgotpassword" REST call, except contains a temporary token that is good for 24hours
  
• Secondly, when called with the token (in the password field), generates a random password for the user and sends that in an email to the user's registered address.

The "temporary" password can then be used to set the desired password via the Update Password call.

Alternatively:

If your system admin sets the api config variable "api.forgotpassword.url=" an alternative password reset flow will occur that allows redirecting to your own change password page.  This config variable is typically found in your clusters /opt/infinite-home/config/infinite.api.properties file.  This config variable can contain a substitution variable $$HASH$$ which will be replaced with the 24h token e.g. api.forgotpassword.url=http://www.mylogin.com?hash=$$HASH$$ will be replaced to http://www.mylogin.com?hash=my_hash_12345

The first email sent requesting if you want to do a password reset will now contain this link instead of the link back to the forgot password api.  Typically you would use this so the user can be transferred to a password reset form on your ui.  From your ui you can send a request to the password reset api with the passed on token to change the password to their requested new password e.g. http://infinite.ikanow.com/api/auth/forgotpassword?password=my_hash_12345&new_password=WZRHGrsBESr8wYFZ9sx0tPURuZgG2lmzyvWpwXPKz8U%3D

Additional config parameters you can setup to modify the sent email are:
api.forgotpassword.url={url to login ui you want} - supports replacing $$HASH$$ with the authentication token needed to change this users password
api.forgotpassword.subject={email subject line you want}
api.forgotpassword.body={email body you want}  - supports replacing $$NAME$$ with users first + last name and $$LINK$$ for the url config param

The new_password is a SHA256 hashed password.  This will change the users password to the passed in password.

• Stage 1:

  {
        response: {
            action: "Reset Password"
            success: true
            message: "Email has been sent containing link to reset password."
            time: 91
        }
  
  }
  

• Stage 2:

  {
        response: {
            action: "Reset Password"
            success: true
            message: "Password reset successfully, new password has been emailed to user."
            time: 91
        }
  
  }