User password reset

Hello, I am testing the CE version of Passbolt.

I’ve run into the following scenario:

One of my team members forgot the password to unlock their vault but still has the secret key.

When attempting a password reset, the process cannot proceed because it asks for both the key and the password.

What is the point of asking for the password from someone who doesn’t remember it and is trying to reset it? That makes absolutely no sense!

It appears that the password reset process either doesn’t exist or doesn’t work as it should.

As the platform administrator, I also cannot initiate a password reset for the user; from what I understand, they have to start over from scratch.

Passbolt’s recommendation is to share passwords with others so they can be shared back in the event of lost access—are you serious?

We are talking about a password vault; the idea is to store all of a user’s access credentials. In most cases, users have unique access rights—why would they share their passwords with others? Sharing shared access credentials is fine, but what about passwords that aren’t for shared access?

So, is it impossible to reset the password so the user can open their vault again, even if they have saved the recovery kit?

How is it possible that a process as simple as a password reset isn’t available?

Guys,

Isn’t possible make a reset password for user ?

Hi Rogerdallaqua,

As far as I’m aware, you’re not able to reset the user’s password. The user’s secrets are stored in Passbolt by first encrypting them with the user’s PGP key on the client, before they’re sent to the server.

The password the user enters is actually the passphrase used to decrypt their PGP private key, it’s not a “password” for their account in the traditional sense. When the user first sets up Passbolt, that key pair is generated and is downloaded to their machine as part of the recovery kit.

Because of how PGP works, there’s no way to reset that passphrase without already knowing it. In CE, if it’s lost, the account has to be deleted and recreated.

Passbolt Pro/Cloud has an “Account Recovery” feature. An admin approved flow to reset the passphrase without needing the old one. This is done by keeping a encrypted backup of the users key on the server. This may be what you are looking for.

Documentation Reference:

https://www.passbolt.com/docs/user/settings/browser/account-recovery-setup/