Page Comparison

Problem Statement or Business Need

The OpenCCC Helpdesk reports an increase in /wiki/spaces/OPENAPPLY/pages/120619069, primarily Username & Password reset issues. In 2015, the percentage of incoming account recovery calls rose to 6.13%, up from 4.3% in 2014. 

The current Account Recovery process requires users to answer security questions to recover/remember their *Password* in order to retrieve their login credentials to signin to OpenCCC account. Often times (X%) the process fails because the student cannot remember their security questions, resulting in calls to the Helpdesk for assistance. At that point, the Helpdesk either helps them regain entry to their security questions or asks them to create a new account. Our system-wide project goal is to minimize duplicate accounts across the system.

Objectives

• Enhance our existing Account Recovery process with minimum amount of changes to existing pages and code as possible to allow Users an alternate way to access their account when they forget their passwords (besides answering security questions). 
• Development will use existing pages and processes wherever possible.
• No changes will be made to the Username recovery process.

• *Ensure that the user experience is user-friendly, cohesive and complete - from where the user starts the process (Apply, Bog, iA or CAI, or Portal) through the full account recovery process and land on their original destination.  

Proposed Solution

mplement new functionality in the account recovery process allowing user to "Reset Password" by way of a secure Email Link sent directly to the Users <email>. The existing Account Verification page will be revised to include two options (radio buttons) to initiate recovery:

1. Send Secure Email Link: send an email to User containing a secure, time-sensitive URL link and simple, minimal text instructions. When the User clicks on the link in the email she is taken directly to the Reset Password page to create a new password. Once the User has new password, she clicks "Continue" to complete the rest of the existing Account Recovery process. (The email link process will land the user on the Reset Password page (in the existing account recovery workflow). No changes are made to the remaining account recovery workflow.)
    
2. Answer Security Questions: display two Security Question text input fields on the revised Account Verification page (conditional display). When both security questions are answered correctly, User is taken to the Reset Password page to create a new password and complete the rest of the existing Account Recovery process. 

Redesign the Account Recovery / Reset Password functionality in two phases:

Phase I; Redesign Account Recovery page to inlude two options:  1) Request email with link to recover password: and 2) maintain our exisint security questions option (using same sequence as we use currently).  

Phase iI:  Add an addtiiona option to send user an SMS Text message with a temporary password - whcich would be reset once they enter Password reset page.

User Stories

Phase I:  As a student user, I want an alternative option to reset my Account password in addition to the existing security questions optoin.  I want tto be able to request an email with a link in it to recovery my password. The email should be simple, clean with minimal wordsThe email should have a link in it that takes me to the existing Password Reset  pageAdd email llink option to the exisint account recovery page 

1. As an OpenCCC Account user, I want a 100% self-service, online account recovery process available, 24/7. 
2. As an OpenCCC Account user, if I forget my Password during the Sign-In process, I want more options available to reset my Password so I can access my account.
3. As an OpenCCC Account user, I want to be able to recovery my forgotten username or password without calling the CCC Helpdesk for assistance. 
4. As an OpenCCC Account user, I want multiple ways to reset my password and access my account besides answering security questions.
5. As an OpenCCC Account user, I want a secure Reset Password link sent to me in an email when I forget my password during Sign-In. 
6. As an OpenCCC Account user, I want to ensure that I am taken back to the application, URL, or portlet that I started the recovery process from after I recovery my account. 

Requirements Summary

Change Specifications

1) Revise layout, text, conditions, and logic on existing Account Verification page to improve password recovery process: 

1. Revise the page layout and update the prompt text as follows:
   
   
   1. Keep the onscreen text, "We found an existing account based on the information you entered. " 
   2. ADD a line of additional text immediately below it to read: "Please select one of the following options:"
   3. REMOVE the Security Questions text input fields from the screen and REPLACE WITH the two radial button response options, shown in blue below:
      
      

      We found an existing account based on the information you entered.

      Please select one of the following options:

      (radio button)   Send me an email link to reset my password.

      (radio button)   Access my account by answering security questions.
      
       

   4. ADD a "Help" link and "Continue" button below the text and radio buttons options box on the lower right (see screen shot). 
      1. Place the existing "Help" link left of the "Continue" button.
      2. Place "Continue" button below text/options area with logic to initiate whatever process the user selects (email or security questions).
   5. Keep all existing CSS styles and Account Verification page attributes, such as the page title (Account Verification), Sign-In button (left side bar), the "Cambiar A Espanol" button, header, and footer, in their current positions; 
      
      
      
      
      
       
2. Add new Conditions to initiate actions triggered by user response to radio button options:
   
   
   1. If user selects Option #1: "Send me an email link to reset my password", then:
      1. Send "Password Reset Email" message to user <email> account with secure, time-sensitive, random URL
      2. Display "Password Reset Email Sent" page with "OK" button to sign out.
          
   2. If user selects Option #2: "Access my account by answering security questions." then:
      1. Roll up text and radio button options below text "We found an existing account based on the information you entered." 
      2. Display Security Questions input fields and "Continue" button to initiate existing field error validations.
         

Breakdown of New Account Verification Page Conditions

2) Show Security Questions input fields and change layout, text, and button position on the Account Verification page when user selects Option #2:

1. If user selects Option #2: "Access my account by answering security questions.", remove text and radio button options (see section identified in Screenshot B below) and display security questions, additional text, buttons and links.
2. Change text on button from "Continue" to "Access Account" 
3. Ensure "Access Account" button and "Help" link are located under the main body of the text and options box in the lower right.
4. Maintain "Cambiar A Espanol" in it's current position - upper right above main body of the text and response options.
    
   
   

  to this   to this  

3)  Requirements for Option #1: Send "Password Reset Email" message with unique URL link and display "Password Reset Email Sent" confirmation page.

If user selects Option 1: "Send me an email link to reset my password" from the Account Verification page, THEN, initiate the following requirements:

1. Send "Password Reset Email" message with unique URL link* to user's <email> address stored in OpenCCC Account. 
   
   

   1. Use the following text in the body of the email

      
      Hello <firstname>
      
      You recently requested to reset your OpenCCC Account password. Click the link below to reset it.
       
      < randomly generated, unique, time-sensitive, authentication URL link to password reset >
      
      

      For security reasons, this password reset link will expire in 24 hours. 

      
      If you did not request a password reset, please ignore this email or contact the CCC Helpdesk to let us know. 
      
      For assistance, contact the CCC Helpdesk
      
      Call: 877-247-4836
      Email: support@openccc.net
      
      
      

   2. Email Subject line:  Your Password Reset Request
      
      
       

2. Generate unique "password reset URL link" and merge into "Password Reset Email" message with the following attributes: (Notes from Jeff Holden 6/14/16:)
   
   1. Generate a random (unique string at the end of the URL) something that shows authentication of user (one time use pass to give that person the email.)
   2. URL itself would have to be a random string - built-in logic to cut the process (cut the IP address) to disallow more than 15 attempts if someone is trying to brute force the system, (Per Jeff, brute forcing would take 100,000 attempts, so 10-15 attempts within 60 seconds (store no longer than a minute and discard) is allowable.) Attempt row or db to track who's attempting brute force (we don't want to store this forever).
   3. Developer would have to create a database table to capture (URL sent, time it was sent and the CCCID that it was sent to) so that the app knows that the URL link is authentic and was sent to that person within time limit against their CCCID).
   4. URL link will time-out 24 hours after email message is sent to user's <email> address"
   5. Add logic to expire URL after 24 hours (User will have to retrieve the link, click and follow the link, and choose a new password before the link expires (24 hours after URL is generated and email is sent). 

NOTE to Developers: It's very important that the User is redirected back into the same workflow they started from. Patty will work with Parker and Josh to describe the goals and objectives for this feature to get assistance articulating all requirements for the URL attributes. Similar to the proxy process, we want the user to have a user-friendly, effective, account recovery experience from start to finish. After the email link is clicked on from the user's email account, they should be taken right into the Reset Password page and after new password is created and user logs in - they should be signing in to the application they originally intended to get to when they started account recovery.

4)  Display "Password Reset Email Sent" confirmation page with the following onscreen text and button links:

1. Create and display new page, "Password Reset Email Sent" with the following text and buttons. 
   1. Page header should be: "Password Reset Email Sent"
   2. The following text should appear in the text box:
      
      A password reset email was sent to <email>
      
      Follow the directions in your email to reset your password.
      If you don't find your email, please check your Spam folder.
      
      
   3. Add an "OK" button in the lower right below the text box.
   4. Add the "Help" link on the left, just adjacent to the "OK" button
   5. Ensure the Cambiar A Espanol button does not appear on the page.
      
      
      
      
2. Link the "Help" link to the existing Help page that currently appears on the Account Recovery, Account Verification, and other pages.
3. Enable the "OK" button to sign the user out of active session and display secure sign out page.

NOTE: Very important that the user is returned to the application they were originally trying to get to before account recovery (i.e., if user started process from a BOG application URL, hit Shib and couldn't remember password and initiated account recovery/password reset using email URL link, after new password is created and confirmed, user is returned to Shib Sign In page and upon successful signin will land on the BOG My Appliications page. The URL attribute for the BOG application will be included in the email URL, including their CCCID.  

#5) Add UI page for when the reset link expires (after 24 hours).

1) Page would appear if the user clicks the URL after 24 hours

Screenshots

Account Verification Password Reset Options

PW Reset Option 1 (Answer Security Questions)

PW Reset Email Link Confirmation

PW Reset Email Link Expired