topic Re: FORCE GUEST USER TO CHANGE PASSWORD AFTER SPONSOR PASSWORD RESET in Network Access Control

FORCE GUEST USER TO CHANGE PASSWORD AFTER SPONSOR PASSWORD RESET

JP_Berlin — Thu, 27 Sep 2018 11:58:56 GMT

Dear community,

we all know the option on ISE guest portals under Guest Change Password Settings: "Require guest to change password at first login (except guests using social login)". My customer now discovered that guests don't have to change their password again after it got reset by a sponsor. They are worried about sponsors being able to see passwords if the user is not pro-actively changing it.

Is there any way to enforce that? If not, are there plans for the future to do that?

Thanks for you answers in advance,

Jonathan

Re: FORCE GUEST USER TO CHANGE PASSWORD AFTER SPONSOR PASSWORD RESET

paul — Thu, 27 Sep 2018 12:47:53 GMT

The sponsors can always see the passwords I believe. When you edit the account in the sponsor portal you can see the password. I don't see what the the concern here is if the guest account are only being used for Internet access.

Re: FORCE GUEST USER TO CHANGE PASSWORD AFTER SPONSOR PASSWORD RESET

JP_Berlin — Thu, 27 Sep 2018 12:58:25 GMT

Hi Paul,

After the user changes his/her password, it is not visible to the sponsor anymore. I also did hide the button for editing the account with a javascript. I personally don't share the concern but my customer is highly sensitive in these regards.

Re: FORCE GUEST USER TO CHANGE PASSWORD AFTER SPONSOR PASSWORD RESET

paul — Thu, 27 Sep 2018 13:20:41 GMT

Ahh good to know. I haven't really worried or looked at the guest password change stuff.

Re: FORCE GUEST USER TO CHANGE PASSWORD AFTER SPONSOR PASSWORD RESET

Jason Kunst — Thu, 27 Sep 2018 16:49:19 GMT

https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/admin_guide/b_ise_admin_guide_23/b_ise_admin_guide_23_chapter_01111.html?bookSearch=true#task_7748374DF52741549486BEFD2407EDAA

look at configure sponsor groups step 7

Re: FORCE GUEST USER TO CHANGE PASSWORD AFTER SPONSOR PASSWORD RESET

JP_Berlin — Thu, 27 Sep 2018 17:11:48 GMT

Thanks Jason,

disabling "view/print guests' password" (actually in step 9) should be satisfying for my customer.