UAC Local user password management

[mcourtney_]

All,

I'm setting up an IC-4500 with the RADIUS plug-in as a AAA solution on a network. Currently, I have some rules in place that map users to certain roles which return RADIUS attributes that set the user on an MX - all good stuff.

The last thing that I'm working on is a way to elegantly have users manage their own passwords. This IC will not connect to a backend authentication server; all of the accounts will be local on the box. Is there a way to create a new sign-in URL that would present a way for a local user to change their username and password? I've tried working on this issue throughout the day and I haven't had any luck.

Worse comes to worse, I can have an admin login and the user can be present while their password is updated - it just feels that there might be something that requires less admin intervention.

Any help on this would be greatly appreciated - thanks!

-Mike

[kalagesan_]

Hi Mike,

Password Management for system local auth server is supported in IC-4500.

You can enable Password Managment by accessing the System Local Auth server Settings where you can enable or disable this option.

you can also enforce end uset for  password change  after X days and also prompt the user for password change  in x days before their current password expires.

Hope this answers your query.

NOTE:
Please mark this post as 'accepted solution' if this answers your question that way it might help others as well, a kudo would be a bonus thanks!!

Regards,
Kannan

[kalagesan_]

Additional information:

when password management is enabled on the local authentication server, If Password Management is not enabled at the realm level, users will be required to change the password as per the Auth server configuration; but will not be prompted for a change due to the Realm configuration.

So, users will not be prompted for the password change and the account will be locked out.

Enable password management on both the System Local Authentication Server page, as well as the corresponding Realm > Authentication Policy > Password page

Regards,

Kannan

[boston1630_]

Hi Kannan,

Thanks for the great information! Does that mean that a user logs into the VPN via a URL and they have access to changing their password settings? Currently I'm receiving an error saying the user is not allowed to access the URL. This is the part that I'm currently hung up on.

Thanks!

-Mike

[kalagesan_]

Hi Mike,

IC-4500 is  access control device and not VPN box. Are you using SSL VPN SA box. 

Password Mangment for local user is supported in Juniper SA device as well.  Once  the user authenticated and given access to the user acces bookmark page , you have to click preferences tab to see the password managment option.

As per your statment I understand that you are facing log in issues, we may need to look in to logs to identify why the user authentication is rejected. password managment option comes in only after user authentication

Hope this resolves your query

Regards,

Kannan

[boston1630_]

Hi Kannan,

I opened a JTAC ticket on this issue. They informed me that what I'm trying to do requires a user licenes on the box. Currently, I have the default localhost license and the full RADIUS license. We should be receiving a test license in the upcoming week - hopefully that will provide the features that I'm looking for.

I will update this post with further questions after I install the user license.

Thanks for your help!

-Mike

[kalagesan_]

Thanks for the update Mike, will wait for the same

Regards,

Kannan

[boston1630_]

Hi Kannan,

We received the user license and we now have advanced features on the box. Here's my new questions: is a user able to manually change their password without administrative intervention? Or, does the password management only prompt the user once their password has expired?

I'd like for a user to be able to change their password whenever they would like.

Thanks for your help!

-Mike

[kalagesan_]

Hi Mike,

Thanks for your response.

I have to test this in my lab set up for confirming the info , will test it and update you soon

Regards,

Kannan

[kalagesan_]

Hi Mike,

In IC  admin UI under password management section of system local  configuration we have the below 3 options enable/disabled.

1.Allow users to change their passwords
2.Force password change after x days
3. Prompt users to change their password x days before current password expires

Your requirement is meeting here. Hope this resolves your query. 

NOTE:
Please mark this post as 'accepted solution' if this answers your question that way it might help others as well, a kudo would be a bonus thanks!!

Regards,
Kannan