Update Password Process

Content

• Overview
• Process Flow
• App Settings
• Update Password User Journey
• API Walkthroughs
• Error Codes
• Revision History

Overview

This Process defines how an existing, authenticated user adds a new password (or updates their current one).

Process Flow

This table describes the Process functionality at a high level.

App Settings

Certain aspects of the Process' behaviour are controlled by configurable application settings.

All app settings are set in the MarketONE ULM Admin web application. System managers and administrators can consult the ULM Admin User Guide.

Update Password User Journey

This flow diagram illustrates the standard user journey using the Update Password Process.

API Walkthroughs

The following section provides guided walkthroughs of the Update Password Process.

Update Password Scenario

An authenticated user selects to add a new password (or change the existing password).

ULM Cloud enforces restrictions on passwords that are used for security purposes, to ensure a minimum standard of security is met (i.e. password length, use of numbers/special characters). Users are encouraged to choose strong, secure passwords as best practices to secure their IDs.

Initial Request

The Process Start API initializes the Process:

<no body>

Response: Prompt User for Passwords

The Process responds with a request to provide both the user's current password and their desired new password:

{
    "processId": "8e32c1b6-f9f2-4cb7-9885-55ba89eeddca",
    "processName": "userManagement.UpdatePassword.v1.0",
    "displayMessage": "Please input required information",
    "parameters": {
        "oldPassword": "String",
        "newPassword": "String"
    },
    "stepName": "PasswordPrompt",
    "lastStep": false
}

Entering the current password acts as proof of the current user's identity (as opposed to another individual attempting to hijack the user's profile).

Response Parameters

Tip: The Process does not ask the user to provide their new desired password twice. However, as a best practice, UIs developed around ULM Cloud Processes and APIs should implement this logic before passing the new credential to ULM Cloud.

Final Request: Provide New Password

The user provides their old and new credentials, and client passes that info to the Process with the Process Step API:

{
    "processId": "8e32c1b6-f9f2-4cb7-9885-55ba89eeddca",
    "parameters": {
        "oldPassword": "L3tm3inplease",
        "newPassword": "thi5i54Sup3rS3cur3p455w0rd"
    }
}

Request Parameters

Response: Success

ULM Cloud saves the new password provided, and the Process ends. The user must now use the new password set whenever they are prompted to provide it.

{
    "processId": "8e32c1b6-f9f2-4cb7-9885-55ba89eeddca",
    "processName": "userManagement.UpdatePassword.v1.0",
    "lastStep": true
}

Response Parameters

Error Scenario: Invalid Password

If the user provides an invalid new password, the Process responds with a HTTP 400 status code.

The body includes a fieldErrors array with the reason(s) as to what went wrong:

{
    "processId": "8bca30ca-dd44-4050-aece-53b0dbed1922",
    "stepName": "PasswordPrompt",
    "lastStep": false,
    "fieldErrors": [
        {
            "field": "credential",
            "code": "NotWeakPassword",
            "rejectedValue": "test",
            "message": "password-regex-rule-violation-.*[0-9].*"
        },
        {
            "field": "credential",
            "code": "NotWeakPassword",
            "rejectedValue": "test",
            "message": "blacklisted-password"
        },
        {
            "field": "credential",
            "code": "NotWeakPassword",
            "rejectedValue": "test",
            "message": "password-regex-rule-violation-.{8,}"
        },
        {
            "field": "credential",
            "code": "NotWeakPassword",
            "rejectedValue": "test",
            "message": "password-regex-rule-violation-.*[A-Z].*"
        }
    ],
    "lastFailedStepAction": {
        "processId": "8e32c1b6-f9f2-4cb7-9885-55ba89eeddca",
        "processName": "userManagement.UpdatePassword.v1.0",
        "stepName": "PasswordPrompt",
        "displayMessage": "Please input required information",
        "parameters": {
            "oldPassword": "String",
            "newPassword": "String"
        }
    }
}

In the above example, the fieldErrors array indicates the following:

• The password fails to include at least one number (0-9)
• The password is on an internal list of commonly banned passwords
• The password fails to meet the minimum length of (8 characters)
• The password fails to include at least one capital (A-Z)

Reminder: Rules are configured under the Password Complexity Rules setting in the MarketONE ULM Admin UI.

The Process also includes a lastStepFailedAction object that repeats the previous Process step's request. The user can re-attempt their request with a different (ideally stronger) password, and complete their onboarding as normal.

Response Parameters

Error Codes

Below is a comprehensive list of potential error codes that may be returned during the execution of this Process.

Common Error Codes

Common Process Error Codes

Process-Specific Error Codes

Revision History