topic Modifying Content Security Policy (CSP) for Portals? in Network Access Control

Modifying Content Security Policy (CSP) for Portals?

alanix@cisco.com — Tue, 23 Jul 2019 02:44:29 GMT

Hey folks,

I have a customer who is looking to implement a search feature for a Self-Registered Portal, where the "Person being visited" field populates with some autocomplete-style results.

Last I heard, this was scheduled to be implemented in ISE 2.7, but I figured it might be possible to do this today with a little code. I'm this close to getting it to work, but since the AJAX request for the LDAP data calls out to a different host, it violates the "script-src" Content Security Policy that ISE is pushing to the browser.

Is there any way to modify the CSP header for the portals so that I can allow AJAX calls to a third-party site?

Re: Modifying Content Security Policy (CSP) for Portals?

hslai — Tue, 23 Jul 2019 04:02:34 GMT

This is not configurable today.

Re: Modifying Content Security Policy (CSP) for Portals?

alanix@cisco.com — Tue, 23 Jul 2019 13:28:29 GMT

Thank you for the quick response!

Is there any thought to possibly providing a way to change the CSP in the future? It would be really beneficial for customers who want to extend the capabilities of their portals.

Re: Modifying Content Security Policy (CSP) for Portals?

hslai — Sat, 27 Jul 2019 04:07:28 GMT

Please connect with our PM directly, if you would like that as a feature.