3015 VPN & Password expiry

Hi, I am currently using a 3015 (ver3.5.5), ACS (3.1) & the VPN client (3.5.1).
I would like to implement password expiry however I do not use the windows domain for authentication - I use the ACS internal database. I don't seem to be able to find anyone else doing this or config examples. Does anyone know if this is possible?
Thanks, John.

John,
ACS (3.1) supports Password expiry configuration.
Cisco Secure ACS supports MS CHAP-based password aging feature which works with the Cisco VPN client (version 3.0 or greater). This feature prompts a user to change his or her password after a login where the user password has expired.
You will need to configure ms-chapv2 password expiration in ACS, and choose "RADIUS with Expiry" on the VPN concentrator.
Oscar

Similar Messages

Notification about password expiry on VPN Client

Hello everyone.
Our VPN users are connected to VPN with VPN Client. We're using VPN3000 to terminate VPN and ACS 5.1 to authenticate users from its internal identity store. VPN3000 gets info from ACS via RADIUS.
Now I want users to be notified about password expiration at their VPN client and be able to change their password.
I've configured:
- "RADIUS with expiry" at VPN3000
- "Disable user account after X days if password was not changed" and "Display reminder after Y days" at ACS
Now user is blocked when his password is expired after X days and he can't connect. But the reminder is not displayed after Y days and users have not chance to change his own password.
If I check "Change password on next login" user can change his password in VPN Client.
Should this feature (password expiry notification) work with ACS5.1 internal identity store and RADIUS?
I found in ACS5.1 release notes the following:
- Internal identity store enhancements include support for Password expiry
but:
- Expiry of any user (admin or internal) after certain number of days is not supported.
I'm confused with these two phrases.
And one more question. What RADIUS attributes say about password expiration and password notification to check them with radlogin?
Thanks in advance for any help.
Pavel

For what it's worth, I've followed that procedure to successfully reset the administrator password on a VPN 3000 concentrator without any loss of the active configuration.

Unable to raise password expiry warning exception in OID using JAVA API

Hi,
We are maintaing the user information for our application in OID(9.2). During logon, it is required that a warning is given to the user according to the value set in "Password Expiration Warning" parameter.
A pl/sql program (using DBMS_LDAP/DBMS_LDAP_UTL packages) written to test password expiry raises the PWD_EXPIRE_WARN exception as expected. However we are unable to simulate the same using the JAVA APIs.
We did try some thing like the following:
public class SampleExpire {
public static void main(String argv[])
throws NamingException {
// Create InitialDirContext
InitialDirContext ctx = ConnectionUtil.getDefaultDirCtx( "TCS-UUODC4",
"4032",
"cn=orcladmin",
"welc0me" );
System.out.println("Hello");
// Create User Objects
User myuser = null,
try {
// Create User using a subscriber DN and the User DN
myuser = new User ( ctx,
Util.IDTYPE_DN,
"uid=C100013, ou=People, o=UUSD",
Util.IDTYPE_DN,
"ou=People, o=UUSD",
false );
catch ( UtilException e ) {
* Exception encountered in User object constructor
System.out.println("User creation failed");
// Authenticate User
try {
myuser.authenticateUser(ctx,User.CREDTYPE_PASSWD,"Z100013");
catch ( UtilException e ) {
* Authenticate fails
System.out.println("Authentication failed");
} // End of SampleExpire.java
The authenticate user does not raise any exception.
Am I missing something ?
Regards -
Adhiraj

Hi,
did you manage to solve this problem? Please let me know

I updated to iso 8 now I cant log into my apple id and its asking for a vpn password that I have never had either

I updated my ipad air to iso 8 and now its asking for a vpn password I have never had one before, and even with my wifi shut off. It also will not let me sign in to my apple id, saying it is the wrong password, but I used it on my computer with no problem. to get to this blog.Tried restarting it, nothing, tried to shut off wifi nothing it will not let me do anything.

User guides
http://manuals.info.apple.com/MANUALS/1000/MA1595/en_US/ipad_user_guide.pdf

Setting password expiry for all users in oracle apps R12

hi,
i have OS RHEL 5,Oracle apps: 12.1.1
now i want to set the password expiry for all the users in oracle apps to 60 days..
can some on please guide on how this could be done.
It is urgent,your help is appreciated.
regards,
Milan Rathod

Hi Milan;
Check below thread
How force users to change passwords every 60 days
How force users to change passwords every 60 days
PS:Registered: Sep 24, 2010
Total Posts: 38
Total Questions: 30 (28 unresolved)
Please change your thread status to anwered which you already get answer for your issue
Regard
Helios

Weblogic Portal 10.3 : Password Expiry Policy for DefaultAuthenticator

Hi,
I wan to create a Password Expiry Policy for Default Authenticator in Weblogic Portal can somebody explain me the steps.
Password: Should be minimum 8 characters and One Capital letter and One Number minimum
Password: Should be expired after 90 days
Thanks in Advance,
Viswanath K

You cannot directly do this as far as I know.
a. Either write your own custom authentication provider that implements these rules, or use an off the shelf LDAP that lets you specify these rules
b. Implement this outside the authenticator (i.e. when the user specifies the password , validate these rules). When the user changes his password , record the date, when the user logs in , check the date for expiry etc,
regards
deepak

Testing the Password Expiry Time

We are using Oracle-Application-Server-10g/10.1.2.0.2 on Linux. We have prevented the username "portal" password from expiring with its default expiry time of 60 days by changing the password expiry time to 99999999999999999 with the Oracle Directory Manager/Oracle Internet Directory (OID). We have stopped and started the services in Portal just in case it was necessary to do so in order for the changes to take effect.
Some questions:
1. Does making the above change affect ONLY the "portal" password expiry time? We noticed that other usernames/passwords created by portal are still expiring at 60 days. If it only affects the portal username, how do we change the password expiry time for users already created within the system?
2. Does the new password expiry time setting affect only the new users created after the change is made?
3. Does anyone know what will happen if I the password expiry time is set to "0"? Basically, we'd like to set it so that the password does not expire.
I suppose we could test all of this by letting the passwords expire (including portal's) but we are trying to avoid that since we are in a production environment.
I would appreciate any input anyone may have.

To respond to question 3 : if the value is 0, then
the password does not expire. By default, user
passwords never expire.It is correct that ...... 'If the value is 0, then the password does not expire.'
<b>Incorrect:</b> ...... 'By default, user passwords never expire.'
Please see the following link for the default password policy settings.
http://download-uk.oracle.com/docs/cd/B15904_01/manage.1012/b14082/pwdpolicies.htm#i1047430
"The default password policy for Oracle Internet Directory enforces:
* Password expiration in 60 days
* Account lockout after 10 login failures. Except for the super user account, all accounts remain locked for a duration of 24 hours unless the passwords are reset by the directory administrator. A user account stays locked even after the lockout duration has passed unless the user binds with the correct password "

Password expiry tracking report

Hi,
Appreciate anyone can help me.
I have change the password expiry setting in the RZ10, from 30 days to 60 days.
Is they any report tracking to check on the password expiry upon reset the password instead of counting it manually?Can we get this info via SUIM?
Thanks.

Hi,
Transaction RSUSR200 List User According to Logon Date and Password Change. Use the selection option No. days since password change.
If this isn't what you are looking for you may have to create a custom report based on the values in table USR02.
Cheers
Bill

Setting password expiry using the SDK

Without using the iDS console, meaning just by using the SDK, could I set the period for password expiry?
Since the userPassword is a multi-value attribute, how can I differentiate between which is the password for signing-onto the server and which are passwords for other applications?

If you mean to configure the password policy using the SDK, a Modify operation for the base object "cn=config" and replacing the value of "PasswordMaxAge" attribute will work.
If you intend to set a specific expiration time for a specific user, you should not do this and let the server set the expiration time based on the configured password ploicy.
For more information on the password policy configuration, you can refer to the Administration Guide.
Also, although userPassword is multivalued, the pasword policy as currently defined in the Directory server suppose that the userPassword attribute contains only 1 value. If the password contains more than 1 value, the result of the password policy is undefined.
And there is no way to differentiate between passwords.
Regards,
Ludovic.

Password expiry option for sql server logins

Hi Experts,
Can we set 'password expiry option' at a time for sqlserver logins as in sybase.
Thanks
Shashikala

Correct. Applies only to SQL Server logins
Best Regards,Uri Dimant SQL Server MVP,
http://sqlblog.com/blogs/uri_dimant/
MS SQL optimization: MS SQL Development and Optimization
MS SQL Consulting:
Large scale of database and data cleansing
Remote DBA Services:
Improves MS SQL Database Performance
SQL Server Integration Services:
Business Intelligence

Urgent - code to get password expiry days

HI
can anyone tell me what should be the code to get the password expiry days means the value of expiry days
Thanks
shashank
Ur answer must be appreciate.

Hi Shashank,
Just a suggestion...
If you're not able to get it from the LDAP, then you may have to work with this:
In the IUserAccount Class, there is a method called: getLastPasswordChangedDate().
Get that date, and add on the days that you set for Password Validity period.
This could be used as a workaround !
Regards,
harman

Code to get password expiry days.

HI
Can anyone tell me what is the code to get the password expiry days.
Thanks
shashank

Hi Shashank,
umservice = (IUserManagementService)PortalRuntime.getRuntimeResources().getService("com.sap.portal.usermanagement.usermanagement");
Properties umeProps = new Properties();
umeProps.load(umservice.readUM_PCDFile("sapum.properties"));
String expDays = umeProps.getProperty( "ume.logon.security_policy.password_expire_days");
Hope it helps
Detlev

Disable password expiry in Portal V2

Hello,
Is it possible to disable password expiry in Portal V2 (ias902).
I do not password to expire for some users at all.
Thanks,
Ritendra.

Hi Kaustubh,
Refer this link:
how to disable the "change of password" field in login page of SAP portal?
Regards,
jithin

VPN password won't stick

I enter my VPN password in the Network settings but the password won't stick. I keep getting a dialog box that asks me to re-enter it. This just started to happen. How to fix?
Thanks in advance,
Ken

Hello,
Is there more than one entry for that account in Keychain Access?
I mean there should be 2, one for incoming & one for outgoing.
The Password rejection can confuse people since it's a catch all meaning...
This Password, Username, Authentication method... is not recognized on this Port to this Server, or a server end problem.
If using a browser to login via WebMail works it's not Name or Password, but one of the other ones.
The receiving email ports are:
IMAP is port 143
IMAP-SSL is port 993
POP is port 110
POP-SSL is port 995
Outgoing ports are...
SMTP and SMTP-SSL is on ports 25, 587 and 465. Port 587 has to be SSL, and port 465 is enforced TLS-wrapped and is generally used by Outlook users.
Is it gMail maybe?
Gmail send but not receive...
Here are two steps that have come in handy in related situations
1) login to gmail on your computer or device via a web browser
2) once logged in successfully, go to this URL to unlock:
https://www.google.com/accounts/DisplayUnlockCaptch

Urgent - usr password expiry days.

HI
I set the Password expiry value to 1 day System Admin >> Sys cofig>>um configuration> security settings. Then after one day when i checked , user password is not expired and user can login with his same old password .
Can any one tell me what should i do to for that.

Hi,
first: You only need to restart the server when performing changes to the UM configuration, not when changing user accounts.
Second: What are you using as UME data source: an ABAP system, the J2EE database or an external LDAP server?
Third: Have you taken a look into your system's trace files (default.trc) and logs (esp. security.log)? Anything interesting in there?
Regards,
Dominik

3015 VPN & Password expiry

Similar Messages

Maybe you are looking for