NOTE: user is forced to set force-change-on-reset: true on OpenDJ Password Policy because of OPENAM-5158

Replication steps:

Configuration:
Login as amadmin and
1 Turn on User Self Service.
Go to “Configure->GlobalServices->User Self-Service”
On “General Configuration” tab
“Encryption Key Pair Alias”: “selfserviceenctest”,
“Signing Secret Key Alias”: “selfservicesigntest”. Press “Save Changes” button. On “Forgotten Password” tab enable “Forgotten Password”. Press “Save Changes” button.
2 In the root realm create the “Email Service”.
Go to “Services->Add a Service->Email Service”
“Mail Server Host Name”: “smtp.gmail.com”,
“Mail Server Authentication Username”: “john.smith@gmail.com”,
“Mail Server Authentication Password”: “valid password”,
“Email From Address”: “a@b.com”
Press “Create” button and then “Save Changes” button.
3 Add email address to “demo” user.
Go to “Identities-> demo”.
“Email Address”: “john.smith@gmail.com”. Press “Save Changes” button.
4 Execute ldapmodify on embedded DJ with privilege.ldif file. (see 6privilege.sh)
It creates uid=openamAdmin,ou=people,dc=openam,dc=forgerock,dc=org user which has “proxied-auth” privilege and “userPassword”: “password”.
5 Modify “embedded” “Data Store”.
Go to “Data Stores->embedded”
On “Server Settings” tab
“LDAP Bind DN”: “uid=openamAdmin,ou=people,dc=openam,dc=forgerock,dc=org”,
“LDAP Bing Password”: “password”, "Proxied Authentication using Bind DN": true. Press “Save Changes” button.
6 Create “test” chain with “LDAP” module.
Go to “Authentication->Chains->Add Chain”.
“Name”: “test”. Press “Create” button.
On the next page press “Add a Module” and then
“Select Module”: “LDAP”, “Select Criteria”: “Required”. Press “OK” button and then “Save Changes” button.
7 Modify “LDAP” module.
Go to “Authentication->Modules->LDAP”
“Bind User DN”: “uid=openamAdmin,ou=people,dc=openam,dc=forgerock,dc=org”
“Bind User Password”: “password”
or
“Bind User DN”: “cn=Directory Manager”
“Bind User Password”: relevant password
Press “Save Changes” button.
8 Modify Password Policy
set force-change-on-reset:true (see 6.sh)

There is also a simplified version of this Configuration.

In 4 execute privilege1.ldif

In 5 Modify “embedded” “Data Store”.
Go to “Data Stores->embedded”
On “Server Settings” tab
"Proxied Authentication using Bind DN": true. Press “Save Changes” button.

The Flow:
On the “Login Page” choose “Forgot Password?”
On the next page “Username”: “demo”
and then press “Submit” button.
The next page should show “An email has been sent to the address you entered. Click the link in that email to proceed.”
Go to email press the link and and on the next page change the password (at least 8 character required). After successful change “Your password has been successfully reset. ” is shown.
Login to “test” chain “User name”: “demo”, “Password”: newly created password.
The users “demo” “User Profile” page is shown.

If instead of the new “openamAdmin” user default “Directory Manager” is used, “PASSWORD MUST BE RESET” page is displayed.