topic secure acs 5.4 user properties screenshot request + how to set n in Network Access Control

secure acs 5.4 user properties screenshot request + how to set no-expire password on service account?

paul.cainkar — Mon, 11 Mar 2019 02:58:31 GMT

1) Would someone be so kind to post a screenshot of secureacs 5.4 user properties showing the per-user expiration/account lock policy that is now available to be overridding at a per-user level?

2) Is there a way yet in 5.4 to set a password to never expire for a service account?

secure acs 5.4 user properties screenshot request + how to set n

jrabinow — Mon, 14 Jan 2013 23:29:57 GMT

For question 2) can do the following

It is enabled by creating attributes for internal users

This functionality is enabled as follows:

- In : System Administration > Configuration > Dictionaries > Identity > Internal Users add Boolean attribute ACS‐RESERVED‐Never‐Expired and set its default value to "false".

- Set this user attribute to be true in the internal user definitions of those users whose password should never expire.

secure acs 5.4 user properties screenshot request + how to set n

paul.cainkar — Mon, 14 Jan 2013 23:37:28 GMT

I've previously tried this without success:

Screenshots:

http://i.imgur.com/pryQn.png

http://i.imgur.com/nwPRZ.png

The account still expires for not changing the password every "x" days.

Do any of the new per-user security options in 5.4 address this is a more clean manner? However, I'd certainly like to get this working too.

secure acs 5.4 user properties screenshot request + how to set n

fpenland808 — Mon, 04 Mar 2013 22:50:48 GMT

I have the same issue, settings match Paul's screen shots however service account passwords are still expiring. Any sugestions would be apreciated.

Thanks.

secure acs 5.4 user properties screenshot request + how to set n

jrabinow — Mon, 11 Mar 2013 09:25:24 GMT

I was able to recreate the issue you described on my ACS 5.4 system and also saw users still expiring.

I have reported the issue and will update when get confirmation of any analysis on this issue

secure acs 5.4 user properties screenshot request + how to set n

fpenland808 — Mon, 18 Mar 2013 21:49:14 GMT

We are running ACS version 5.4.0.46.0a, I had a TAC case open for another issue and asked the engineer about this and they mentioned that they thought the issue should be resolved in the latest patch. I setup ACS in a lab to test this just have not gotten around to it yet but if you are running the latest build and still having the issue it will save me some time.

Let me know what build you are running that is still having this issue.

Thanks.

secure acs 5.4 user properties screenshot request + how to set n

jrabinow — Mon, 18 Mar 2013 21:53:41 GMT

It is not yet resolved in latest patch for ACS 5.4 (patch 2)

Target is for patch 3; do not have any ETA yet

Following is the CDETS to be tracked:

CSCue30822 Password expiration with Boolean

secure acs 5.4 user properties screenshot request + how to set n

jrabinow — Sun, 07 Apr 2013 07:06:58 GMT

I have dug in some more here.

Currently the user will not expire if the following setting is selected

System Administration > Users > Authentication Settings

	If password not changed after		days :
	Disable user account
	Expire the password

Option to expire the password must be selected. Then users with the attribute set to true wil never expire and other users will have the passwords expire after this interval and will be forced to change password on next login providing that use a protocol that supports change password. Otherwise authentication will fail with

Authentication failed :

24203 User need to change password

secure acs 5.4 user properties screenshot request + how to set n

jrabinow — Fri, 17 May 2013 12:37:10 GMT

The issue has been resolved in ACS 5.4 patch 3. With following fix

CSCuf16197 ACS-RESERVED-Never-Expired does not prevent user account from expiring

Now irrespective of whether select the "Expire the password" or "Disable user account" neither of these options will take effect if the ACS-RESERVED-Never-Expired attribute is set to tru

An additional fix of interest in this patch may be

CSCuc58345 Even with ACS-RESERVED-Never-Expired ACS counts down days until expiry

secure acs 5.4 user properties screenshot request + how to set n

paul.cainkar — Mon, 19 Aug 2013 16:53:11 GMT

Is this to suggest that the configuration based on the screenshots I provided above should prevent account expiration with the patch? If yes, something is still not working correctly. Has anyone else got this to work?

secure acs 5.4 user properties screenshot request + how to set n

paul.cainkar — Mon, 23 Sep 2013 21:40:05 GMT

secure acs 5.4 user properties screenshot request + how to set n

paul.cainkar — Mon, 25 Nov 2013 16:59:52 GMT

I'm still having this problem. BTT.

secure acs 5.4 user properties screenshot request + how to set n

jrabinow — Mon, 25 Nov 2013 20:45:08 GMT

We have not seen others hitting this problem and without further details I can't really help assess further

Note that ACS 5.5 was posted today and includes the following enhancement:

CSCty77259: ACS 5 global password policy for local user should have per user ignore

Re: secure acs 5.4 user properties screenshot request + how to s

paul.cainkar — Tue, 26 Nov 2013 23:04:41 GMT

Is there any additional information I can provide which will assist you? I am running 5.4.0.46.4.

The screenshots in the top of this thread are mine.

If you're suggesting 5.5 has a "disable password policy for user entirely" style knob this may work in lieu of disabling password expiration enforcement per user. However, I do not know if I will have the ability to upgrade to 5.5 right now.

secure acs 5.4 user properties screenshot request + how to set n

paul.cainkar — Mon, 23 Dec 2013 01:47:09 GMT

This just happened again. I tried completely deleting the account and re-creating it, with no further success. It's a service account and predictable, it starts to fail to funciton when it's password expires because it can't be succesfully overridden from general policy.

I am still not able to access that bug as it is not Cisco customer visible.