Presenting conditional form elements in a complex scenario

Question

I am currently building an interface for creating user accounts within a system. This interface is to be used by system administrators.

I am currently unsure as to what's the best way to present the following scenario for setting the user's password:

• We an define a password for the account or ask the system to generate one.
• We can force the user to change his password upon login.
• We can ask the system to email the user his login and password for confirmation.
• It is possible that we are creating an account for the user over the phone.

I came up with an interface like so:

^{download bmml source – Wireframes created with Balsamiq Mockups}

^{download bmml source}

There seems to be a few problems though:

• The form looks somewhat "bulky" and slow to fill in.
• A welcome email is always sent. But if the user checks the checkbox, we also send the username and password. Is there a way to communicate this better?
• Sending the username and password by plain text is usually frowned upon. See this website dedicated to compiling a list of offenders. If the user elects to send the usernamd and password by email, should we always force the user to change password on login?
• Is there a simplier way to achieve the user flow, keeping in mind that we should be able to define a password or allow the system to automatically generate one?
• Currently, once the user clicks create account, we redirect them to a page with a list of all accounts and show a flash message that says account created successfully:

^{download bmml source}

However, accounts can have many fields (some optional and some required) depending on how the administrator has configured the system. In our signup page, only the absolutely required fields are displayed. We feel that in cases where an automatically generated password is used, if the account is created for a customer over the phone, he might breeze through the form, click create account and realized that he forgot to note down the password to give to the customer. Should we then have a gateway page like so (after account creation)?

^{download bmml source}

I also feel that the gateway page offers too many choices for the user's "next move". Is there a better way to do this if a gateway page is recommended?

Answer 1

I'm thinking of an approach along these lines:

1. Create the user but always generate a random password (this means get rid of the checkbox and the inputs of type and retype password) and send it to user, via email in the same mail as the welcome one there's no need for two emails in my point of view

2. Store the password encrypted (of your choice could be md5) + salting (optional) the password in your database

3. Always force or at least encourage user in the email to change password on first login (this also removes the other checkboxes)

4. For the forgot password case maybe you can bcc the welcome email or prepare a forgot password form for the users in the UI, this will save u a lot of future work

I think this approach also gets rid of the gateway page.