Take a look at OpenUnison (our project) https://github.com/TremoloSecurity/openunison-qs-freeipa it integrated with ipa and let's you setup password reset self service pretty easily. 

Marc Boorshtein
CTO, Tremolo Security, Inc.

On Thu, Oct 18, 2018, 9:58 AM William Muriithi via FreeIPA-users <freeipa-users@lists.fedorahosted.org> wrote:
Hello,

I am looking for a way of allowing users to reset their password
without going through the VPN.  I usually send users notification when
the password are about to expire, but they don't follow up until
something stop working.  At that point, they can't even VPN.

Have anyone else exposed IPA to the public and have it faired well?

Also, is there a way of changing one way trust (The default) to two
way trust without first removing the current trust?

Regards,
William
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org