topic Re: ISE Password Change Portal (UCP) with My Devices Portal Customization in Network Access Control

ISE Password Change Portal (UCP) with My Devices Portal Customization

disoares — Mon, 07 Nov 2016 19:48:26 GMT

Hi team,

My customer plans to migrate to ISE and today they use the UCP feature in ACS to change enable passwords. Will this feature be included in ISE?

Thanks,

Diego

Re: ISE support for UCP

Jason Kunst — Mon, 07 Nov 2016 19:54:23 GMT

There is no native User change password portal in ISE but I have posted a way to make the My Devices Portal into a password change portal. This is for internal accounts and not for the enable password change, for product feature request please reach out to the ISE Product Managers internally through account team.

ACS to ISE comparison

https://communities.cisco.com/docs/DOC-63901

Re: ISE support for UCP

Jason Kunst — Thu, 27 Jun 2019 18:00:16 GMT

Steps to configure a My Devices portal as a User Change Password Portal

Changing passwords in ISE portals are not available for external ID stores today (active directory).

Access the Command-Line Interface to Change the Enable Password would work for AD users, however.

Be aware of this bug as well, it may have impact in your environment. Make sure running 2.2 with latest patch or 2.4 as current recommended long term releases as of 2/25/19
CSCvb96836 Change password flag is not reseting itself after password change happened under my devices portal

Behavior

1. User logins with old credentials

2. After click on "OK" button he redirecting to "Change password" page. "My devices" page is hidden.

3. After success changing password he got an alert password change is complete. (Using ISE browser will see My Devices Portal in background)

4. After click on "Ok" button he redirecting to "Login" page.

After login again goes through same process over again

There are 3 scripts, one for my devices and one for the password change page as well.

The password change functionality in ISE only works for internal user accounts and can be done via the Sponsor or My Devices Portals, ISE cannot change the enable password

These steps will change the behavior of the MYdevices Portal to send the user to password change immediately after they login to the portal. The script automatically selects password change. After the user changes the password there is no indication besides it returning the use to the my devices page where the user should sign-out

See this doc with working with javascript to understand how to use it

http://www.cisco.com/c/dam/en/us/td/docs/security/ise/how_to/HowTo-43_ISE_Web_Portal_Customization_Options.pdf

Make sure you have an internal user to test with and a valid identity source sequence

Navigate to Administration > Identity Management > Identities
Create an account and add to the employee group (end of the account creation page)
(Optional as by default internal users is part of this sequence) Navigate to Administration > Identity Management > Identity Source Sequence > MyDevices_Portal_Sequence

Steps to configure Portal Settings

Navigate to WorkCenters > BYOD > Portal & Components (or Configure) > My Devices Portals
Create a new My Devices Portal and name it User Password Change Portal
Under portal settings:
1. (optional) configure a FQDN such as passwordchange.domain.com (optional)
2. make sure you have a valid authentication method to match the proper group
Under Post Login banner page settings uncheck the option
Under Employee change password settings check the box for allow internal users to change their own passwords

Steps to customize portal

Choose Portal Page Customization at the top of the page
Under Global Page Customization > Text Elements > Banner Title change banner form My Devices Portal to User Password Change Portal
Under Pages > Login > Instructional Text change it to " You may change your password through this portal"
Under Pages > My Devices > optional content 2 toggle into HTML Source and paste in the script below:
Toggle out of HTML source
Save the page in the upper right of page
Click on the portal test URL button

Information on the script.

If you don't have this script the user will have to select password change in the upper right of the portal. This hides everything to the user so they only go to the password change screen (you may briefly see the My Devices page if your delay value below is not correct and needs to be tuned)

2.4 my devices page script

<script>
$(document).on('pageshow', function() {
    $('.ui-panel-content-wrap').hide();
    var error = $('.cisco-ise-errors');                 
    var hasErrors = error.length > 0;
    var passwordChanged = sessionStorage.getItem('passwordChanged') == "true";
    if (passwordChanged) {
        alert('Password has been changed successfully.');
        sessionStorage.setItem('passwordChanged', false);
        document.forms['logout'].submit();
    }
    else if (!passwordChanged){
        document.forms['changePasswordPreLoad'].submit();
    }      
});                                                                                                       
</script>

Login Page Script
<script>
$(document).on('pageshow', function() {
    sessionStorage.setItem('passwordChanged', false);
});
</script>

This is delay (200). If you have slow ISE server, you should raise this delay to 500 or sometimes to 1000 (ms).

The reason of using this delay is for those have a latent connection to the PSN

Sometimes, when page is loaded fast, you can see how one button of colour changing to another (when PC is fast).

Please adjust to your liking

On the change password page put this in under Optional Content, this will log you out of the portal after you change the password so the user doesn't get in a loop going back to change password. It also presents a message after the password is changed to tell them

You will need to replace the portal ID below with the one from your My Devices Portal, this can be found in your browser URL bar

portal=71180af0-e387-11e6-aeb1-005056873bd0

2.4 code script for change password

<script>
setTimeout(function(){
    sessionStorage.setItem('passwordChanged', false);
    $('#ui_changepwd_cancel_button').attr('href', 'javascript&colon;document.forms["logout"].submit()');
 
    $('#ui_changepwd_submit_button').on('click', function(evt){
        sessionStorage.setItem('passwordChanged', true);
    });
}, 1000);
</script>

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Idea NOC — Fri, 20 Jan 2017 05:26:31 GMT

Hi All, i have tried with same procedure, after login page we got blank screen, please suggest me how to get change password page after login page.

Re: ISE support for UCP

Jason Kunst — Mon, 23 Jan 2017 15:12:40 GMT

I updated the 1st script please try that, also what browser and ISE version are you using if still problems

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

juliegottfried — Tue, 21 Mar 2017 16:50:46 GMT

I followed your instructions, and everything through the first script works fine (step 7). The user is prompted to change password, the password gets changed, but then you see the "change password" screen again (the loop that was mentioned).

In an attempt to fix this loop, I added the 2nd script in the "change password page" under Optional Content1 by toggling the html button, and it broke the password change function. Now after the initial log in, the browser just hangs. I also tried it in optional content 2, with no difference. I am running ISE 2.1 and Firefox 52.0, 32 bit. How can I get this to work?

Thanks-

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

juliegottfried — Tue, 21 Mar 2017 23:34:13 GMT

Jason,

Thank you for your reply! I have carefully cut and pasted the script, paying careful attention not to include extra spaces, and toggled the html screen. I tried numerous times but got the same result of the browser hanging. Then I tried omitting the following 2 lines:

var logoutUrl = $('.ui-popup-container .ui-btn-icon-right:nth-child(3) a').attr('href');

window.location = logoutUrl;

and it worked fine. I get the pop-up alert that says 'Password has been changed', and the change is successful when tested.

But then of course it takes you back to the previous screen. It still may be ok this way because at least the user gets the confirmation that their change was successful. It is probably useable this way, but I can't figure out why the logout part of the script is not working for me though.

Thanks!

v/r

Julie

Re: ISE support for UCP

Jason Kunst — Wed, 22 Mar 2017 12:14:43 GMT

I added new script in the original reply at the end, please try

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

juliegottfried — Wed, 22 Mar 2017 16:17:18 GMT

I will try the new script, but I started seeing "error loading page" messages on the password change page when trying to submit the password change. I have tried creating a new portal with only the first script and settings, and have tried stopping and restarting the ise app, but no luck getting past this error. I don't know why this has started appearing.

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Jason Kunst — Wed, 22 Mar 2017 16:25:15 GMT

Is this with a clean portal and no javascript? If so please work with TAC sorry

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

juliegottfried — Wed, 22 Mar 2017 16:28:33 GMT

Yes, clean portal and just your first script. I will have to contact the TAC before proceeding with your new script. Thanks-

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Jason Kunst — Wed, 22 Mar 2017 16:30:40 GMT

How about without any script

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

juliegottfried — Wed, 22 Mar 2017 17:37:21 GMT

OK, I'm past the error, (bug CSCuw29841-using an illegal<or > character in password) and am ready to try the new script. Where do I find the URL for the My devices portal? Is this the administration -->"My Devices" MENU item's URL (the menu item that takes you to the My Devices Portal(default) and User Password Change Portal? Or is it the url of the My Devices Portal (default)? Thanks!

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

juliegottfried — Wed, 22 Mar 2017 17:52:06 GMT

OK, I'm past the error after a bit of research, (bug CSCuw29841-using an illegal<or > character in password--which explains the intermittency of the problem) and am ready to try the new script. Where do I find the URL for the My devices portal? Is this the administration -->"My Devices" MENU item's URL (the menu item that takes you to the My Devices Portal(default) and User Password Change Portal? Or is it the url of the My Devices Portal (default)? Thanks!

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Jason Kunst — Wed, 22 Mar 2017 17:54:04 GMT

When you open the my devices portal the portal id is part of the URL

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

juliegottfried — Wed, 22 Mar 2017 19:47:26 GMT

I actually found the portal id only after clicking "portal test URL". It is portal=0af591e0-0f22-11e7-a828-cc46d6f7a563 I replaced it in the script, but the browser still hangs like before.

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Serhii Pustovit — Thu, 23 Mar 2017 12:31:36 GMT

Hi Julie,

Could you please try to use this script?

$('#ui_changepwd_submit_button').on('click', function(evt){

sessionStorage.setItem('passwordChanged', true);

});

$(document).on('pageshow', function() {

var error = $('.cisco-ise-errors');

var hasErrors = error.length > 0;

var passwordChanged = sessionStorage.getItem('passwordChanged') == "true";

if (!hasErrors && passwordChanged) {

alert('Password has been changed');

sessionStorage.setItem('passwordChanged', false);

var logoutUrl = $('[href="Logout.action?portal=0af591e0-0f22-11e7-a828-cc46d6f7a563"]').attr('href');

window.location = logoutUrl;

};

});

</script>

It should works only with portal ID, which you told before.

Thanks.

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Jason Kunst — Thu, 23 Mar 2017 13:04:31 GMT

To clarify from developer

I inserted customer's portal ID for that script.

I think customer accidentally deleted something like quote and it wont work.

I tested it on different portal, so it should work.

This is one way to Sign out. However I tested a few more ways, but they are not works.

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

juliegottfried — Wed, 05 Apr 2017 15:08:23 GMT

This script works! After you get the "password has been changed" message, you get an "error loading page" for about 8 seconds before getting back to the sign on page, but that is a minor thing, and everything else works great. Thank you very much!

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Damon Peterson — Thu, 31 Aug 2017 15:06:10 GMT

Maybe something broke this in a recent update. Very well done but I enabled it today and it never moved from "my devices" to change password. So the first script doesn't seem to be working.

topic Re: ISE Password Change Portal (UCP) with My Devices Portal Customization in Network Access Control

ISE Password Change Portal (UCP) with My Devices Portal Customization

Re: ISE support for UCP

Re: ISE support for UCP

Steps to configure a My Devices portal as a User Change Password Portal

Be aware of this bug as well, it may have impact in your environment. Make sure running 2.2 with latest patch or 2.4 as current recommended long term releases as of 2/25/19CSCvb96836 Change password flag is not reseting itself after password change happened under my devices portal

Make sure you have an internal user to test with and a valid identity source sequence

Steps to configure Portal Settings

Steps to customize portal

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Re: ISE support for UCP

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Re: ISE support for UCP

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Re: ISE Password Change Portal (UCP) with My Devices Portal Customization

Be aware of this bug as well, it may have impact in your environment. Make sure running 2.2 with latest patch or 2.4 as current recommended long term releases as of 2/25/19
CSCvb96836 Change password flag is not reseting itself after password change happened under my devices portal