<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body>
<div>
<div>
<div dir="ltr">
<div>We have integrated our midpoint with Azure AD for Single Sign On, which also enforces MFA. Once they are logged in, they are assigned a role that gives them the ability to update certain details and request roles and resources through a self service functionality.
We don’t encourage the use of midpoint for password resets though - we use SSPR in Azure AD for that.</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">-Stefano </div>
</div>
</div>
<div id="ms-outlook-mobile-signature">
<div></div>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> midPoint <midpoint-bounces@lists.evolveum.com> on behalf of Matthew Mize via midPoint <midpoint@lists.evolveum.com><br>
<b>Sent:</b> Saturday, October 1, 2022 3:27:45 AM<br>
<b>To:</b> midpoint@lists.evolveum.com <midpoint@lists.evolveum.com><br>
<b>Cc:</b> Matthew Mize <mmize1@udayton.edu><br>
<b>Subject:</b> [midPoint] Midpoint Security Question</font>
<div> </div>
</div>
<div>
<div dir="ltr">Hello everyone,
<div><br>
</div>
<div>As we are working through our Midpoint rollout, we've started discussing how best to allow our end users to self-manage their passwords. One of our options is to allow end users login access to Midpoint itself, where they would use the UI to keep their
passwords up to date. However, we try to be a very security conscious organization and, because of the sensitive data that could be exposed if a malicious actor were to gain access to the admin side of Midpoint, would typically want to place the Midpoint administrator
UI in a protected zone in our network.</div>
<div><br>
</div>
<div>We're wondering what, if anything, other institutions have done. Do you allow your end users login access directly to Midpoint? If so, what steps do you take to keep end-user access and administrator access separate? If you do not have end users manage
their passwords in Midpoint, what product(s) do you recommend?</div>
<div><br>
</div>
<div>Thanks much!<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr" class="x_gmail_signature" data-smartmail="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div><span style="font-size:small">------------------------------------------------------------------------</span><br style="font-size:small">
<span style="font-size:small">Matt Mize,</span> (he, him, his)</div>
<div>Director, Software Engineering & Web Engineering</div>
<div><a href="mailto:mmize1@udayton.edu" target="_blank" style="color:rgb(17,85,204)">mmize1@udayton.edu</a><br>
</div>
<div>
<div style="font-size:small"><a href="https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.name-coach.com%2Fmatt-mize&data=05%7C01%7Cstefano%40everythinginfo.cloud%7Cb95ddd36f8ab4076389a08daa3092272%7Ce066da37c938490cbf598264850113a8%7C1%7C0%7C638001556900347248%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=73dRok1u7J7wzjUSFv3JQljcXPYmwTruLSqRm1zAE4E%3D&reserved=0" originalsrc="https://www.name-coach.com/matt-mize" shash="VO/AEr0BnK7JtiKu61gZYWDgMG+aoa2D40DWlNCy+mOvqVLtANYNNu4/jRjLkXqREhjtG0XdEg2z6Yy2FdocTZgjWMJtjHUQBxfAc+im6r3KUj++HyiOk3MzwU/8prRx2/sQn48TgHNMrL2MGYgWNSRxnz4Yl9SfkOJ+XAFO/Ls=" target="_blank" style="border-radius:0px; color:rgb(136,91,192); font-family:"Open Sans",Arial,sans-serif; font-size:20px; outline:0px"><img alt="A button with "Hear my name" text for name playback in email signature" src="https://www.name-coach.com/images/emailsig/email-sig.jpeg" width="96" height="27" style="border-radius:0px; border:0px; vertical-align:middle; margin-top:4px; margin-bottom:15px"></a><br>
</div>
<div style="font-size:small">IT Service Center, (937) 229-3888, <a href="mailto:itservicecenter@udayton.edu" target="_blank" style="color:rgb(17,85,204)">itservicecenter@udayton.edu</a><br>
</div>
<div style="font-size:small"><br>
</div>
<div style="font-size:small">University of Dayton<br>
300 College Park, Dayton, OH, 45469-2230<br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>