topic Re: Preventing sponsor from creating guest account using certain email domains in Network Access Control

Preventing sponsor from creating guest account using certain email domains

scott.stapleton — Mon, 05 Aug 2019 13:59:17 GMT

I want to prevent sponsors from entering an email addresses for the sponsored account that contains a few domains (e.g. - @example.com).

I didn't have luck using the first script detailed here:

https://community.cisco.com/t5/security-documents/ise-sponsor-portal-create-known-accounts-page-customization/ta-p/3636414#toc-hId--1080596999

I had more luck using the second lot of 3 x scripts. However they are written for the person being visited; not the email of the sponsored guest. I've modified the script so that it works on the email address field.

One problem remains; it does the opposite of what it is supposed to do. It is supposed to prevent users entering corporate domain email adddresses (i.e. - black-listing certain domains) but instead it only allows the domains listed in the script (white-listing).

How can the script be changed so that the domains listed in the script are prevented?

See below:

Re: Preventing sponsor from creating guest account using certain email domains

Jason Kunst — Mon, 05 Aug 2019 16:17:26 GMT

Researching for updated script

Re: Preventing sponsor from creating guest account using certain email domains

scott.stapleton — Tue, 06 Aug 2019 08:30:57 GMT

Cheers Jason.

Re: Preventing sponsor from creating guest account using certain email domains

scott.stapleton — Thu, 08 Aug 2019 13:00:36 GMT

@Jason Kunst Did you have any luck chasing down a script?

Re: Preventing sponsor from creating guest account using certain email domains

Jason Kunst — Thu, 08 Aug 2019 13:24:59 GMT

Still working on it. I was on vacation. Should hopefully have this week

Re: Preventing sponsor from creating guest account using certain email domains

scott.stapleton — Thu, 08 Aug 2019 14:41:13 GMT

Great - thanks.

Re: Preventing sponsor from creating guest account using certain email domains

sivsivar — Sat, 10 Aug 2019 15:44:15 GMT

Hi Scott,

Please check the script in the below community page under heading "Restrict the email address entered when creating a known account".

https://community.cisco.com/t5/security-documents/ise-sponsor-portal-create-known-accounts-page-customization/ta-p/3636414

Re: Preventing sponsor from creating guest account using certain email domains

scott.stapleton — Mon, 12 Aug 2019 11:18:18 GMT

Thanks - this works although I did need to change the .personBeingVisited to .emailAddress.

One issue however; the script works based on domain; not FQDN. Therefore it blocks domain1.com and domain1.net. I only want it to block domain1.com. I'm unable to specify the FQDN; if I do the script doesn't work. Can it be modified so that the FQDN and not just the domain can be entered?

Re: Preventing sponsor from creating guest account using certain email domains

sivsivar — Tue, 13 Aug 2019 08:07:48 GMT

Hi Scott,

can you please try the below script.

<script> 
    $(document).on("pageshow", function(){ 
        setTimeout(function() {
            $('.emailAddress').val("");
            var domains = ["domain1.com","domain2.net","domain3.com"];
 
            function validateDomain(me){
                var idx1 = me.target.value.indexOf("@");
                if(idx1>-1){
                    var splitStr = me.target.value.split("@");
                    if(domains.indexOf(splitStr[1])>-1){
                        me.target.value="";
                        alert("Enter a valid email address.");
                        return false;
                    }
                }
            }
 
            $(function () {
                $('.emailAddress').blur(function (ele) {
                    validateDomain(ele);
                });
            });
        }, 5000);
    }); 
</script>

Re: Preventing sponsor from creating guest account using certain email domains

scott.stapleton — Wed, 14 Aug 2019 07:26:43 GMT

This worked well; thanks very much.