Passwordstate Documentation

Password Reset Portal Module ​

The Password Reset Portal (PRP) is an additional module available for Passwordstate, which is installed as its own stand-alone website.

The website can be installed on any Windows server of your choice, and typically you would host this in your DMZ, but it really depends on your requirements. You could install it on your existing Passwordstate webserver, on another shared server in your DMZ, or even on a server you have provisioned in the cloud.

The PRP website communicates securely back to your main Passwordstate website, with all traffic encrypted within the SSL tunnel. All business logic like authentication, verification, resetting passwords etc, is performed by your core Passwordstate website.

The PRP website is merely the front facing website your users will access to initial the resetting, or the unlocking of their Active Directory password.

From your PRP Server, you must have appropriate ports open back to your Passwordstate web server i.e. generally Port 443, unless you are using a non-standard port by default for HTTPS.

By default, Kerberos will be used for communication back to your domain when password resets or account unlocks are requested, and ports 88 and 464 need to be open on your domain for this to work.

Alternative to Kerberos, you may wish to use LDAPS for Active Directory Communication, which instead uses Port 636.

Summary of these Ports can be found below:

Password Reset Portal Ports ​

Your users will need to connect to your Password Reset Portal (PRP) website, which is installed using Port 443. This will present them to the page to begin the process of resetting or unlocking their own Active Directory password/account.

Passwordstate Web Site Ports ​

The Password Reset Portal (PRP) needs to communicate back to your Passwordstate API, so generally Port 443 is required to be open on your Passwordstate webserver. If you are using a different port for your Passwordstate website, then this port will instead need to be open.

Domain Ports ​

  • Port 636 - this is required if using LDAP over SSL (LDAPS), so the Passwordstate UI and API can communicate with Active Directory to reset and unlock accounts
  • Port 88 and 464 is required if using Kerberos, so the Passwordstate UI and API can communicate with Active Directory to reset and unlock accounts
  • Ports 135 and Dynamic Ports - To query Event Logs on Domain Controllers for account lockouts, Port 135 needs to be open, and also the existing Windows Firewall rule "Remote Event Log Management (RPC)", which uses dynamic ports