1

I am creating a form that will allows dealers of my company's product to create user accounts for their customers. When creating a new account, they can either set the password with the form, or have an email sent to the customer that will direct them to set their own password. I would like to set it up so the default to be "send email to user" without any action from the user.

User Scenario: An admin-level user at a dealer is creating a user account for a new customer. When filling out the form, they keep the default option of letting the user set their own password. (Which is done by sending an email to the user and directing them to a reset password page)

Alternate: The admin-level user sets the password for the user account.

What is the best way to implement this so that it will be clear the admin-level user what they are doing without being so wordy?

| improve this question | |
  • 1
    If the admin sets the password how do they inform the user what that password is? Tell them over the phone? Email it to them in plain-text? I can't really think of why you'd even offer that as an option really, the security issues seem impractical to say the least. Don't even offer it as an option, add some text on the screen saying 'user will be able to set their password on first log-in' or something. – JonW♦ Jul 29 '13 at 15:32
  • 1
    "I can't really think of why you'd even offer that as an option really," To be frank, you don't really need to. We have already reached the conclusion that for this scenario, we need to include as an option. I'm looking for advice on how to smoothly implement it, not on what needs to be implemented. – Mason240 Jul 29 '13 at 16:02
  • Can I ask how this was resolved? I have a similar situation (we have a setting where last name can be defaulted as a password). Sounds like you didn't get an answer on this thread but it's been 6 months so I assume you had to come to some sort of conclusion. And if you did, do you force users to change the system-assigned default or is it acceptable to leave it, despite the fact it's not very secure? Much thanks!! – Nancy_Mc Jan 24 '14 at 14:52
1

Mason, If I'm reading this right, you want to push the admin toward letting the user set his password, but the admin needs to be able to set the password if necessary.

Could you make the first choice the only option on the new user creation like so:

mockup

download bmml source – Wireframes created with Balsamiq Mockups

and then provide a separate Reset Password option for any existing user to the Admin to provide the "Set it myself" work-around? I know this isn't exactly what you asked for, just throwing a different approach out to see if it solves your problem.

| improve this answer | |
  • woah! Zombie thread - my fault for not looking at dates. – Daniel Jan 24 '14 at 15:51
  • I ended doing something very similar. Here is a screenshot. The two password feilds are revealed when the user clicks on the button. I really like the idea of not even labeling the Password field to subtly reinforce that it is not a typical operation. – Mason240 Jan 24 '14 at 18:01
0

When the admin-level user creates a user account NO password is generated.

At the end of the user creation process an e-mail is sent to the user with a link to set the password.

The user clicks the link and is taken to the password set/change page. No further operation on the system is allowed until the user has set the password. The link will auto-expire after a certain amount of time.

In this way an admin-level user won't know the users passwords (obvious security implications) and the user will be able to choose his/her own password.

Hint: instead of storing the passwords store their "hash"

| improve this answer | |
  • The ability for admins to set passwords is requirement for this case. If it wasn't, I wouldn't be asking this question, I would just set the password via email. – Mason240 Jul 29 '13 at 15:55
  • Then the real issue is sending the password securely to the users. There is a thread on IT Security – Toni Toni Chopper Jul 29 '13 at 16:03
  • Also, I'm fully aware of how to salt and hash passwords, I do so on every password system I implement - but that is not what I am asking about. – Mason240 Jul 29 '13 at 16:04
  • The password is going to either be given in person or on the phone with customer when setting up the account. – Mason240 Jul 29 '13 at 16:05
  • Ok so I understand that communicating the password to the user is not a concern. In this case you could always require a password when creating a user account and always ask the user to change it upon the first login. The admins won't be confused and the users neither. – Toni Toni Chopper Jul 29 '13 at 16:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.