For registered users at TWiki.org:
Forgot your password?	See ResetPassword
Want to change your password?	See ChangePassword

---

People forget passwords, and TWiki has no exception, particularly when users rarely log in to TWiki (mainly browsing not contributing). This is a significant usability and TWiki adoption issue - see HowToGetInternalBuyInForTWiki for one example.

(A related problem is GettingTheUsernameWrong, which does have an easy solution.)

There are some approaches to fixing the password-forgetting problem e.g. the IE5 and Mozilla password-remembering features - however, most people seem not to use this, even when it's mentioned on the registration page, and there are inherent security risks in such a system. A stronger approach is to re-use some existing authentication that is already done outside TWiki, e.g. logging on to a file server, or some local 'single sign-on' system.

Some sites (e.g. DrKW) have leveraged single-signon through use of browser-based per-user certificates (used to log in via an SSL webserver and authenticate certificates - see TWikiPluginAPIForIdentification) - this is reasonable if you are using certificates for other reasons, but most companies probably aren't. Others have done something similar with the SiteMinderPlugin. For sites without this infrastructure, it is simpler to let TWiki use cookies to remember the user session, either with TWiki's own authentication (TemplateLogin) or using an Apache module to handle login (ApacheLogin).

A low-tech solution is to

1. always have an in-person induction session with new TWiki users, even if it's on the phone and
2. walk them through registration and first login so that
3. they check the 'Save Password' box on InternetExplorer or MozillaBrowser.

This has some added benefits, as it also lets you familiarise them with TWiki basics and help them create their home page.

Related pages:

• TransparentAuthentication
• GettingTheUsernameWrong - how to help people who forget they should use a WikiName when logging in
• WhoIsTheRemoteUserInView - discusses implementation of 'remember remote user based on IP address', which enables pages viewed after editing to know who the user is (useful for TWikiSkins).
• IntranetDoubleAuthentication - general discussion

-- Contributors: RichardDonkin, RandyKramer, CrawfordCurrie