Cisco ISE 2.4 - Changing the Login and Enable Password for Non-Admins Identities

[mpbaker82]

I hope this is a quick question,

what is the quickest way for users (non-admins) in my identities to change, or reset their passwords?

is it possible to have them go to the PAN url, type in their username, current password, select "internal", then be prompted for a password change when their accounts expire? I really dont want to have to setup a ucp if i dont need too.

thanks

[Jason Kunst · Accepted solution]

The only way to change is to use the sponsor or my devices portal AFAIK
https://community.cisco.com/t5/identity-services-engine-ise/ise-password-change-portal-ucp-with-my-devices-portal/td-p/3475680

[mpbaker82]

Is there anything in the 2.4 admin guide that explains this better then those links to other forum post? I did read that post that you linked too prior to posting this but didn’t like it plus it was 2 years old and more focused on version 2.1. There were major changes in ISE in later versions. Not to mention the post isn’t very clear. Is there anything that explains how to set up a device portal? Step by step? 

Thanks 

[Jason Kunst]

No there Is nothing in the admin guide. This is a hack of the my devices portal. As I stated before you can change password on this and the sponsor portal as well

The my devices portal is already setup and should just work. You will need plus licensing for this. Then use my post to hide elements. Or just use it as is.

Sponsor portal can be used with base licensing

There is no password change portal like ACS had.

Perhaps someone can make a better post for this but i can’t currently as I am traveling .

[mpbaker82]

You mention that it requires plus license. I have seven ISE nodes. Primary, Secondary, and five policy service nodes. Would I need to buy a plus license for each of these or can I just get plus for the primary and secondary?

I’ll check out the sponsor portal today.

Thanks for taking the time to reply to my previous post.

[Surendra]

Licenses in ISE except Device Admin and VM licenses, are based on number of endpoints that you would like to use this licenses for and not the number of nodes you have in the deployment.
You can purchase plus license for say 500 endpoints and install it. It would be applicable for a maximum of 500 endpoints at any given point of time irrespective of how many ever nodes you have in the deployment.

[mpbaker82]

Thank you all for the help and support.
I think I can make this work from here.

[hslai]

Assuming for TACACS+ (device admin), we can do this on the NADs, without using an ISE portal. See 

Solved: Re: ISE 2.x internal user password chan... - Cisco Community