We're currently looking to implement a secure AD password self-reset feature for our users. Our scenario is to manage people who forgot their password, not those who want to change it. Our users are usually based on remote locations and most of the time don't have access to a VPN. Our first thought was to provide a web-interface where users must authenticate using their username and an authentication factor which could be:
- A private question/answer;
- An OTP sent by text message to a user's pre-registered mobile phone;
- An OTP included in a password reset link sent to a user's pre-registered private email address (e.g. Gmail).
But due to organizational constrains, we cannot rely on text messages to send an OTP, and we don't consider the question/answer to be secure enough. So we are left with the private email option, which still concerns us because:
- The email provider or the email account could be compromised;
- The email provider will be able to associate an email with our organization (which can be an issue sometimes);
- We consider it would open the door for phishing attacks - going against our communication to users saying that they should never, ever open a link that pretends to come from the organization on a private email address.
So is there a way to allow users to reset their AD password without using text messages or private emails, and without using a commercial (paying) solution?