Novell ACCESS MANAGER 3.1 SP2 - IDENTITY SERVER GUIDE 2010 Manual page 128

Parameter
<USERID>
<STOREID>
<RETURN_URL>
action=expire
For example:
https://someservice.com/path/password?user=<USERID>&store=<STOREID>
&returl=<RETURN_URL>&action=expire
NOTE: If you copy and paste this text, make sure you remove the white space between
and
&returl
The Identity Server fills in these values, which results in the following URL:
https://someservice.com/path/password?user=joe.novell&store=userstore1&
returl=https://myidp.com/nidp/idff/sso&action=expire
Forcing Authentication after the Password Has Changed
The password service can also include parameters on the return URL sent to the Identity Server. The
Identity Server understands the following parameter:
Parameter
forceAuth=TRUE
The following example sends this parameter with
base URL of the Identity Server.
<form id="externalForm" action='https://testnidp.novell.com:8443/nidp/idff/
sso?sid=0&id=117&forceAuth=TRUE' method="post">
When the user is redirected to the password management service URL because of an expired
password, the POST data in that redirect contains the
used for the Identity Server return URL.
Grace Logins
If you specify a password service and do not specify a value for the number of grace logins in
eDirectory, the contract redirects to the password management service only when the grace login
count has reached 0 and the password has expired.
128 Novell Access Manager 3.1 SP2 Identity Server Guide
Description
Provides the DN of the user with a password that is expired or expiring.
Provides the name of the user store that authenticated the user before
redirecting the user to the password expiration service.
Provides the URL at the Identity Server to which the user can be redirected
after the password service completes.
Causes the password expiration service to behave as though the user's
password policy is set to allow the user to reset the password even though the
user's policy might be set to show the user a hint. The user sees the page to
create a new password rather than seeing a hint for an existing password.
.
Description
When the user is returned to the Identity Server, this parameter forces the
user to authenticate with the new password. This eliminates the possibility of
an old password being used in an Identity Injection policy.
https://testnidp.novell.com:8443
and values as part of the value
sid=<> id=<>
<STOREID>
as the