anyconnect with Gina 4.10 Documentation on AD password exp. over vpn

[TRNnHelp]

Looking for some current Documentation on how to allow password change over VPN after the password has expired.  Everything I find is old.  We are on anyconnect 4.10 with Gina

[Rob Ingram · Accepted solution]

@TRNnHelp configure the password-management command, the ASA notifies the remote user at login that the user’s current password is about to expire or has expired. The ASA then offers the user the opportunity to change the password. If the current password has not yet expired, the user can still log in using that password. 

This command is configured under the tunnel-group.

Refer to this guide for more information: https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/I-R/asa-command-ref-I-R/pa-pn-commands.html#wp2035813333

[TRNnHelp]

I'm trying to allow our active directory users to change their active directory Passwords after they expire across the VPN. This article doesn't appear to address that.

[Rob Ingram]

From the link provided......

"When you configure the password-management command, the ASA notifies the remote user at login that the user’s current password is about to expire or has expired. The ASA then offers the user the opportunity to change the password. If the current password has not yet expired, the user can still log in using that password."

"This command is valid for AAA servers that support such notification; that is, natively to LDAP servers and RADIUS proxied to an NT 4.0 or Active Directory server."