Hello,
We have a couple different systems/processes where we create Laserfiche User accounts in LFDS for external users to log into things like WebLink or Laserfiche Forms.
One of the most common "issues" is that users will contact us saying that the password reset link isn't being sent to them and from what I can tell this is happening because of user error; they try entering their email address rather than their actual username, type it wrong, etc.
What further complicates things is that after you enter a login or email on the password reset page, you see the "An email has been sent to your account." message even if you entered invalid information.
This creates a lot of confusion for our external users so I've modified the STS pages for our external site to try and add some clarification, but I have to re-do those changes whenever we update.
I think it would be beneficial to make a couple of changes to the behavior:
1) Allow passwords to be reset with username OR email address.
This is a fairly common option which is why I think people tend to default to their email and it would be helpful if LFDS would just send the reset link and a reminder of the actual login name as long as the email they enter is associated with a valid account.
EDIT: As Samuel Carson points out below, this may not be the ideal solution because, with good reason, the system does not enforce uniqueness on the email address tied to LFDS accounts meaning you can easily have a 1:many on reverse lookups.
2) Change the message displayed after requesting a password reset.
The current message can give the implication that it is always successful and that there must be some other issue at play when what really happened is that they entered a bad username from the start.
Updating the verbiage to clarify that a link will only be sent if a valid account is found could help alleviate that to some degree since some people even sent in a screenshot of that to backup up their claim of "see it said it worked but I never got the email"
Really it could go either way on this one because some sites/apps will tell you upfront if there's no account matching what you enter which can be helpful but would probably require attempt limits to prevent account testing. Other sites/apps will simply show an "if the information is valid..." kind of message without confirming on way or the other, which leaves the users a little unsure but is the more secure approach.