We’re improving and simplifying the password reset process for MIDAS v4.19.
Due to the secure way passwords are stored by MIDAS, it’s not possible to “recover” a forgotten password. The only option if a password is forgotten is to request a password reset.
In the past, this process has been as follows:
- User clicks the “Forgot Your Password?” link on their MIDAS login screen
- The user then enters their email address and clicks “Reset My Password”
- MIDAS then emails the user with a reset confirmation link
- The user clicks the reset confirmation link
- MIDAS emails the user a new temporary password (which they’re required to change upon their next login)
We’re simplifying this process and so from v4.19 the process will instead be as follows:
- User clicks the “Forgot Your Password?” link on their MIDAS login screen
- The user then enters their email address and clicks “Reset My Password”
- MIDAS then emails the user with a temporary login link
- The user clicks the temporary login link and is prompted to enter a new password after which the user is logged in
Better Password Resets
This simplified password reset process removes the sending on two emails to users (a reset link followed by a temporary password), as just a single email will be sent. This also strengthens security as a temporary password is no longer sent via email.
This improved flow also addresses the issue of multiple password reset attempts and emails arriving out-of-order. For instance, take the following scenario:
- User initiates a password reset, receives an email with a reset link and clicks it
- Whilst the user is waiting for a new temporary password to be sent to them, the initiate a further password reset and click the reset link in that corresponding email
- The original temporary password email arrives, and the user attempts to use the temporary password. However, as they since initiated a second password reset request, the first temporary password is no longer valid
This caused confusion for a handful of users who’d attempted to reset their password several times within a matter of minutes couldn’t understand why the temporary password they received wasn’t being accepted.
Multiple Password Resets
The improved password reset flow for MIDAS v4.19 completely eliminates this. Even if a user initiates multiple password reset requests the links they receive via email will all permit the user to set a new password, until they have done so.
We’re sure these improvements will make it easier and stress free for users to reset their own passwords.
Along with these changes, administrators can also still specify how long password reset links are valid for (the default is 2 hours). This setting may be found via MIDAS Admin Options → Manage MIDAS → Security. For more information, please refer to the help documentation.
Of course, if a user isn’t able to reset their own password, any other administrative user who has been granted the “Can Manage Users & Permissions” user permission can reset a user password on their behalf.
Click here to continue reading about some of the other new & improved features coming in MIDAS v4.19!
Throughout May we’ve been migrating our domain’s security certificates. We’ve transitioned from certificates issued by GlobalSign to ones issued by 
Our password strength indicator has been a feature for administrators creating new user accounts since v4.07. For v4.13, we’ve also made this useful visual indicator available whenever an end-users changes their password. The visual indicator classifies the password as either “Very Weak”, “Weak”, “Fair”, “Good” or “Strong” as you type, with a corresponding color to match (i.e. Red = Very Weak, Orange = Fair, Green = Strong). This classification is based upon a number of factors including the length of the password, the presence of upper and lower case letters as well as numbers and special characters, and whether the password has been banned.