ACS Appliance - Local User Password Changing Options

I am configuring a pair of 1113 appliances running ACS 4.2. The client wants to only user local user accounts stored in the ACS database for AAA on devices and LMS and Ops Manager logins. There are configurable password aging settings for users and groups. The question that I have is how are the users notified that their passwords are expired and ow can they change them? The customer uses only ssh for device management. Is the UCP utility still a requirement if an appliance is used as opposed to a standard Windows ACS installation. I also came across this bug:
SCsj50218 Bug Details
Password expiry feature should be support for users local to ACS
Symptom:
ACS currently does not support password expiry / password management feature for locally configured users.
Conditions:
users are configured locally on ACS as opposed to an external database such as active directory.
Workaround:
user external database / server where user profiles are setup.

ACS supports Password Aging for Device-hosted Sessions-Users must be in the CiscoSecure user database, the AAA client must be running TACACS+, and the connection must use Telnet. You can control the ability of users to change passwords during a device-hosted Telnet session.
You can also control whether Cisco Secure ACS propagates passwords changed by this
feature.
UCP is used in both appliance and window.
Regards,
~JG
Do rate helpful posts

Similar Messages

LDAP User Password changing...

Hi all,
We use windows AD LDAP server for central user administration..
I am trying to change the password of my own in the portal server..how can i do this ?
When i see the password change option in Useradmin/identity management under All data sources, i can see 1.LDAP
2.UME Database
Can i just choose LDAP and Click "Generate New Password " ?
I would like to know exact procedure to change the password..( no matter what the password policy is )
Please help..Appreciate your time and will be rewarded with points if helpful.
Thanks!
Addy

> There are standard UME configs that are set to read/write and readonly. The name of the config normally has it as part of the name - readonly or writeable.
Where can i check the UME config settings to LDAP ?
> If your LDAP product doesn't have a web based frontend,
I don't know if they have any..I know the LDAP server Hostname.How do i login to LDAP WebUI using a webpage ? ( eg : hostname: port/xxx )
How do you make sure the LDAP product's password rules are enforced?>
> Make it a problem for the LDAP administrator!
From Portal side, how do i check if the LDAP rules are being enforced or not ? If it is not, then i can raise a question to LDAP Admin. And i cannot send a request to change the password for me everytime i want right ?
Any good docs on Portal with LDAP ?
Thanks!
Addy

User Password change fails in OWA 2013

User Password change fails in OWA with this error: Your password couldn't be changed. Make sure the old password you typed is correct and that the new password meets the minimum security requirements.
We are migrating from Exchange 2007 to Exchange 2013. Have mailboxes in both environments. OWA 2007 password changes succeed (user mailbox is still in Exchange 2007). When the user mailbox is moved to Exchange 2013, password changes fail
with the above error.
We have the Exch 2013 servers are on Windows 2012 and we are running Exch 2013 CU3. We have made changes to the Default Role Assignment Policy to prevent users from changing Contact information and setting user photos, etc. We are not exactly
sure when user password changes stopped working, or even if they ever did work, although we recently installed our Prod Exch 2013 servers alongside our 2007 servers without any RBAC delegation implemented and a quick test of a user password change was successful.
I reversed all the changes to the Default Role Assignment Policy but the password change still fails.

Hi,
Please try the following steps in your CAS server:
1. Click Start > Run and type regedit and click OK.
2. Navigate to the "HKLM\SYSTEM\CurrentControlSet\Services\MSExchange OWA" key.
3. Set the ChangeExpiredPasswordEnabled value from 1 to 0.
4. Close regedit and re-open it.
5. Set the ChangeExpiredPasswordEnabled value from 0 to 1.
6. Close regedit.
7. After you configure this DWORD value, please reset IIS. The recommended method to reset IIS is to use IISReset /noforce from a command prompt.
Here is the similar thread about password change issue in Exchange 2013 CU3, please refer to:
http://social.technet.microsoft.com/Forums/en-US/30b74c81-9b98-46f4-9ca0-1c3bb74f4a3f/users-with-expired-passwords-or-change-password-at-next-logon-unable-to-change-password-via-owa-in?forum=exchangesvrclients
Hope it helps.
Thanks,
Winnie Liang
TechNet Community Support

Registration of user password change in Oracle Identity Manager 9.1.0.2

Where I can find record in Oracle Identity Manager 9.1.0.2, if a user password change.
There any log, report, etc ...?
thank you very much

Check this: Re: Audit when change password fails
-Bikash

How to monitor user password changes for users in a database.

hi All,
can someone please help me.
I need to audit the user password changes in a database. Ive check the auditing but audit " alter user " doesnt audit the changes in password and ive also checked the select * from sys.user_history$; view but didnt find anything useful. So is there a way to trace who changed the password and when ?
Thanks for the help.

You need something along the lines of http://www.morganslibrary.org/reference/ddl_trigger.html
or you need to disallow ALTER USER to everyone and write your own PL/SQL and instrument logging the changes.
Sybrand Bakker
Senior Oracle DBA

5508 WLC - 7.0.98.218 - Local users password reset

We are required to change passwords every so often at my job. I am trying to change the password for one of the local user accounts on a 5508 WLC running 7.0.98.218 - How can I accomplish this task? The option I get is to remove the users. Any help would be much appriciated.
Thanks,
marramix01

Hi,
I think ur speaking about LOCAL NET USERs list on the WLC..
I am able to change that on my WLC..
its .. WLC GUI >> SECURITY >> LOCAL NET USERS >> Client on the local user >> Edit it >> Apply.
Clisk on the name which is under USERNAME and u wil be able to edit it!!
Lemme know if this helps and please dont forget to rate the usefull posts!!
Regards
Surendra

ACS 5.3 UCP Password Change

Hi at all,
i have a Problem with the UCP Webside Password Change.
The Side is running without Problem. A Password Change for the normal User is also o.k.
Here me Problem.
I will use this Side also for our Admins to Change here Password but this User has also a Enable Password.
Is it Possible to Change also this Password with the UCP Webside?
Thanks for help.
regards
Andreas

Hey Tushar,
That is our current setup. Right now each user logs in with their AD credentials to get into user exec mode and the same password to get into privileged exec mode. I would like to have a user login with their normal AD credentials to get into user exec mode and a different password (specific to each user, not locally on the device) to login to privileged exec mode. We are doing this for security reasons. Hopefully that clarifys what I'm trying to do.
Thanks

USER PASSWORD RESET OPTION

Hi,
We have published our server through ITS. Once users logged on they access through Webui. I would like to provide users the option for themselves to change their own password.Please suggest how to achieve this
Regards
D.Mukundan

Hi,
You can provide the custom screen for changing the password.
Standard FM's are available to change the password.
ME_USER_CHANGE_PASSWORD
But, I think you should go with the standard password change mechanism which is the normal login screen where user logs into web ui.
Regards,
Naresh

Weblogic admin user password change w/o disrupting existing users

Hi Folks,
As a business policy we need to change the password of the admin user in weblogic after a cycle of specific period.
Please let us now how can we do that without losing the other existing users in 'my realm.'
I understand that we can use the weblogic.utils.security.AdminAcoount utility to give the new password, which will create a new DefaultAuthenticatorInit.ldift file in +<domain-home>/security+ folder (according to Doc ID 1082299.1).
The password will change but the users in 'my realm' will be lost. (there are many users and it is a production environment so recreation is out-of- question)
Is there a way we can retain the users and still proceed with the password change?
Cheers,
Jeegar

Hi Jeegar,
This can be doen by followin the standard procedure by login to console and navigate to :-
DOMAIN_STRUCTURE--->Security Realm--->myrealm--->Users and Groups---->User tab click on the user weblogic
--click on the password tab and put the new password there and save (password is changed for the user here)
---Logout from the console and login to the console again using the new password
But when the server starts it do not read the password for the user directly from the realm rather it picked the same from the $DOMAIN_HOME/servers/AdminServer/security/boot.properties
Now in order to make this change available when the server starts change the values for the username and password in boot.properties and specify them in plain-text and save the same.
Now next time whenever the server will start it will pick up the new values from the boot.properties and once the same had been accepted those will be encrypted again.
You might have to make the change for the boot.properties for all the Managed Server if you have the Managed Servers in the domain which will be located at the location $DOMAIN_HOME/servers/<<Managed Server Name>>/data/nodemanager/boot.properties
You can test the steps on some lower environment first and try the same in Critical environment once the testing goes successful.
Regards,
Vijay
Edited by: V Kumar on Oct 25, 2012 3:06 PM

Importing Security Through shared services caused admin user password chang

Hi,
I exported shared services from shared services url from one environment and imported into another environment. This changed the admin user password where I imported.
Details:-
I went to shared services of one environment say dev and to -> Applications Groups -> Foundation -> shared services and exported it. Took its export and imported into test environment.
Now what it did it changed the user password of the target with the source one. However I did remove the internal ID of all files in it.
Can anyone please help ? How to get the password of it back? I do not have back up of shared services of test environment.
Version 11.1.2.1
Thanks a lot in advance!!!!!!!!!!!!!!!!!!!!

I was hoping you had a strategy in place, it is basically restoring the shared services relational database from a backup, stop the epm related services first.
It may be even possible to correct your LCM file and set the admin to the way it should be but I am not sure what state the provisioning is in so couldnt guarantee it would work.
Cheers
John
http://john-goodwin.blogspot.com/

Local user password still needed to install updates

I've got machines connected to open directory and even when I'm logged into them as a Directory Admin when it comes to installing Software Updates or software I always get asked for a local admin username and password, the open directory admin usernames just get rejected.
Is there a way around this? I want my Directory Admin users to have full admin rights over the machines.

Hi,
The Directory Administrators on the Open Directory Domain need to have a Primary Group ID of 80 to be able to do this, which can be changed in WGM under the group options. I am hoping 10.5 improves on this method, along with allowing the delegation of admin rights more granular in abilities.
Thanks
Gary

OIM Startup Error After weblogic user password change

Hello,
I'm running OIM 10g (BP15) on WLS server in clustered mode. Everything was running smoothly until -
I changed the weblogic password after going to
security realms >myrealm >Users and Groups >weblogic > Passwords:
I was able to login to WLS using new cred (weblogic/newpasswd). But OIM server startup started giving login errors as below.
I reverted back by change by setting the old password again... but the error continued....
Please suggest. I already tried putting the correct passwords in the boot.properties. But it didn't help.
Please note.. i'm successfully able to login to WLS console.. only OIM server startup is having below errors..
OIM_SERVER1.log is opened. All server side log events will be written to this file.>
<Jan 26, 2012 6:44:31 PM PST> <Notice> <Security> <BEA-090082> <Security initializing using security realm myrealm.>
ERROR,26 Jan 2012 18:44:53,194,[XELLERATE.ACCOUNTMANAGEMENT],Class/Method: Authenticate/connect User with ID: WEBLOGIC was not found in Xellerate.
ERROR,26 Jan 2012 18:44:53,202,[XELLERATE.ACCOUNTMANAGEMENT],Class/Method: XellerateLoginModuleImpl/login encounter some problems:
com.thortech.xl.security.tcLoginException:
at com.thortech.xl.security.tcLoginExceptionUtil.createException(tcLoginExceptionUtil.java:96)
at com.thortech.xl.security.tcLoginExceptionUtil.createException(tcLoginExceptionUtil.java:53)
at com.thortech.xl.security.Authenticate.connect(Authenticate.java:152)
at com.thortech.xl.security.Authenticate.connect(Authenticate.java:71)
at com.thortech.xl.security.wl.XellerateLoginModuleImpl.login(XellerateLoginModuleImpl.java:159)
at com.bea.common.security.internal.service.LoginModuleWrapper$1.run(LoginModuleWrapper.java:110)
at com.bea.common.security.internal.service.LoginModuleWrapper.login(LoginModuleWrapper.java:106)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
at javax.security.auth.login.LoginContext.login(LoginContext.java:579)
at com.bea.common.security.internal.service.JAASLoginServiceImpl.login(JAASLoginServiceImpl.java:113)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at com.bea.common.security.internal.utils.Delegator$ProxyInvocationHandler.invoke(Delegator.java:57)
at $Proxy22.login(Unknown Source)
at weblogic.security.service.internal.WLSJAASLoginServiceImpl$ServiceImpl.login(WLSJAASLoginServiceImpl.java:89)
at com.bea.common.security.internal.service.JAASAuthenticationServiceImpl.authenticate(JAASAuthenticationServiceImpl.java:82)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at com.bea.common.security.internal.utils.Delegator$ProxyInvocationHandler.invoke(Delegator.java:57)
at $Proxy40.authenticate(Unknown Source)
at weblogic.security.service.WLSJAASAuthenticationServiceWrapper.authenticate(WLSJAASAuthenticationServiceWrapper.java:40)
at weblogic.security.service.PrincipalAuthenticator.authenticate(PrincipalAuthenticator.java:348)
at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.doBootAuthorization(CommonSecurityServiceManagerDelegateImpl.java:929)
at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.initialize(CommonSecurityServiceManagerDelegateImpl.java:1050)
at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:873)
at weblogic.security.SecurityService.start(SecurityService.java:141)
at weblogic.t3.srvr.SubsystemRequest.run(SubsystemRequest.java:64)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:209)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:178)
<Jan 26, 2012 6:44:53 PM PST> <Critical> <Security> <BEA-090402> <Authentication denied: Boot identity not valid; The user name and/or password from the boot identity file (boot.properties) is not valid. The boot identity may have been changed since the boot identity file was created. Please edit and update the boot identity file with the proper values of username and password. The first time the updated boot identity file is used to start the server, these new values are encrypted.>
<Jan 26, 2012 6:44:53 PM PST> <Critical> <WebLogicServer> <BEA-000386> <Server subsystem failed. Reason: weblogic.security.SecurityInitializationException: Authentication denied: Boot identity not valid; The user name and/or password from the boot identity file (boot.properties) is not valid. The boot identity may have been changed since the boot identity file was created. Please edit and update the boot identity file with the proper values of username and password. The first time the updated boot identity file is used to start the server, these new values are encrypted.
weblogic.security.SecurityInitializationException: Authentication denied: Boot identity not valid; The user name and/or password from the boot identity file (boot.properties) is not valid. The boot identity may have been changed since the boot identity file was created. Please edit and update the boot identity file with the proper values of username and password. The first time the updated boot identity file is used to start the server, these new values are encrypted.
at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.doBootAuthorization(CommonSecurityServiceManagerDelegateImpl.java:959)
at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.initialize(CommonSecurityServiceManagerDelegateImpl.java:1050)
at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:873)
at weblogic.security.SecurityService.start(SecurityService.java:141)
at weblogic.t3.srvr.SubsystemRequest.run(SubsystemRequest.java:64)
Truncated. see log file for complete stacktrace
Caused By: javax.security.auth.login.FailedLoginException: [Security:090304]Authentication Failed: User weblogic javax.security.auth.login.FailedLoginException: [Security:090302]Authentication Failed: User weblogic denied
at weblogic.security.providers.authentication.LDAPAtnLoginModuleImpl.login(LDAPAtnLoginModuleImpl.java:261)
at com.bea.common.security.internal.service.LoginModuleWrapper$1.run(LoginModuleWrapper.java:110)
at com.bea.common.security.internal.service.LoginModuleWrapper.login(LoginModuleWrapper.java:106)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
Truncated. see log file for complete stacktrace
>
<Jan 26, 2012 6:44:53 PM PST> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to FAILED>
<Jan 26, 2012 6:44:53 PM PST> <Error> <WebLogicServer> <BEA-000383> <A critical service failed. The server will shut itself down>
<Jan 26, 2012 6:44:53 PM PST> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to FORCE_SHUTTING_DOWN>
Thanks,

Got the solution :
1.     Log on to the WebLogic Server Administration Console.
2.     Click the domain name for the Managed Server.
3.     Click View Domain-wide security settings.
4.     Click the Embedded LDAP tab.
5.     Select the Refresh replica at startup option, and then click Apply.

Report Builder 2.0 User Password Change Issue

A user changed her password (domain account) this morning and can no longer open the query designer (we are using an SSAS data source) or run a report in Report Builder 2.0. She can still access the SSRS front end report manager reports with no issue (and she enters her new password).
When clicking Run for a report in the Report Builder 2.0 the following error message displays:
The request failed with HTTP status 401: Unauthorized.
When trying to open the Query Builder for a dataset in the Report Builder 2.0 the following error message displays:
An existing connection was forcibly closed by the remote host
Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host.
A connection cannot be made. Ensure that the server is running.
The security log in the applicaiton event log on the report server logs the following with each failed attempt:
Unknown user name or bad password.
Three other users have recently reset their passwords and had no issue with Report Builder 2.0. I am thinking that her password may be cached or saved within Report Builder 2.0 and it keeps using her old password. I have had the user reboot and uninstall/reinstall Report Builder 2.0 but neither fixed the issue. It appears after uninstalling that all application data was not removed as recent reports show after reinstalling and I was not prompted for login credentials again. I had our domain admin reset her password back to what it was before she changed her password and all issues in Report Builder 2.0 went away and she could use the Query Builder and run the reports. I need to figure out how to let her change her password and have Report Builder 2.0 work though. Any help is greatly appreciated.

Sorry, going to Options > Settings and clicking "Clear all recent item lists" didn't work for me. My login credentials are still cached, and I'm not prompted to log in, when I launch Report Builder.
I'm running Win7 Professional, IE10. I cleared my browser cache as my first attempt to clear the login, but that didn't work. I even cleared again, making sure to select to clear stored passwords/logins, but that didn't clear it, either.
Best regards,
Brad

Use local admin account to reset local users password?

Everytime I logout or shut down my mac book pro running 10.7.4 I cannot login because the login "shakes" when I put in my password. The local account, userX, is also a mobile account on my home Lion Server network. Even why I try to go through the process of resetting my password using my appleid, the new password doesn't allow userX to logon to the machine, let alone the home network.
Thoughts?

did you see the link? Pertinent info therefrom:
OS X Lion
From the Apple menu choose System Preferences....
From the View menu choose Users & Groups.
Click the lock and authenticate as an administrator account.
Click Login Options....
Click the "Edit..." or "Join..." button at the bottom right.
Click the "Open Directory Utility..." button.
Click the lock in the Directory Utility window.
Enter an administrator account name and password, then click OK.
Choose Enable Root User from the Edit menu.
Enter the root password you wish to use in both the Password and Verify fields, then click OK.

ACS Appliance rejects users from Cisco 4400 WCS

Has anyone seen this error code in your ACS logs? If so, what does it mean? This problem is only occurring with the Wireless Controllers and LEAP users. Below is the message:
"Radius extension DLL rejected user"
Thanks.

Normally I think that means the external database failed the authentication. In the case I just had they were using the NT database and had duplicate accounts with different passwords (one on the domain, and a local NT user). Try different usernames, or try creating a new user just for testing. Make sure the passwords are correct, etc. Also, try using tactest or radtest instead of the Aironet to see if it works for that.

ACS Appliance - Local User Password Changing Options

Similar Messages

Maybe you are looking for