Before performing an action on a user’s account (e.g. unlocking an account/ resetting a password) you must first be sure of their identity. If the person is not known/recognised you should authenticate the user to verify their identity. You will need to ask them to verify two characters from one security answer and one character from another security answer. Follow your local policy on how to communicate with the user about this information and for guidance on what to do if the user forgets the answers to their security questions
To authenticate a user:
1. Click Admin in the navigation bar at the top of the screen and select User Management from the drop down menu.
2. Use the search box to find the account you wish to authenticate
Refer to the Searching for an Entry article for more information
3. Click on the user’s Display Name to open the User Details Page
4. From the User Details Page, click the Authenticate User in the Actions box
The user will be required to provide three characters from two of their security questions answers. Ask the user to provide you with the characters requested for each security answer displayed. Answers to security questions are not case sensitive
5. Enter the characters into the corresponding box
If the answer to the security question is correct a green circle with a tick will be displayed. If the answer to the security question is incorrect a red circle with a cross will be displayed. You must not make any changes to a user’s account until all characters to the security questions have been answered correctly.
6. Once the user has been successfully authenticated, click Back at the bottom of the page to return to the User Details page
- You will never be required to ask a user the full answer to their security question
- Answers to security questions are not case sensitive
- Decision regarding the number of failed attempts to answer security questions is made on an organisational basis- refer to your local policy for guidance on this scenario
