method to let user reset their own password

We don't have SSO/EIM setup in our shop. We are currently looking for a way to allow user to reset his/her own password without having to involve an iseries admin. Below is the only idea that comes to mind:
1) Create a login exit point program that will fire of an email to the user's email address on the last login attempt that caused the profile to be disabled.
2) The email I send to the user will have a very long link that uniquely identified the iseries user ID. When user accesses the email and clicks on the link, it will call a iseries program to reset the password.

Now, the challenge would be how to tie iseries UID to user's email address.


There is probably a better and more full prove solution out there already, so, I thought I ask before reinventing wheel..

thanks