Solved: VPN user getting POP up window to change credentials

riteshmalpani · ‎07-01-2009

Hello,

I have ACS (1113)4.2 which have been configured for External user database authentication. I have my VPN users configured on AD. Now I want the VPN users while connecting to ASA should change their passwords at the first logon.

Any help would be appreciated.

Regards

Ritesh

Jagdeep Gambhir · ‎07-01-2009

Ritesh,

When using a Radius server it will only prompt you to change password once the password is expired or the 'user must change Password' option is checked in AD.

To enable password aging for VPN users we need to have to use following commands under tunnel general attribute mode,

hostname(config-tunnel-general)# password-management

When you enable password-management on the ASA it basically converts the radius requests to MS-CHAP v2 instead of PAP so that AD can pass down expiry information. All the ASA does is send an authentication request to the Radius server. It's up to the Radius server to notify the ASA that the

password is expired and act the go between for the ASA and AD.

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/vpngr

p.html#wp1166346

Regards,

~JG

Do rate helpful posts

View solution in original post

darpotter · ‎07-01-2009

ahhhh... TACACS+

Believe it or not, they did NOT hook the AD password change protocol into the TACACS+ password change mechanism.

So even though you can do T+ through to AD, if the AD server issues a challenge of any type the T+ auth will fail.

Thats the way the cookie crumbles :-(

View solution in original post

darpotter · ‎07-01-2009

Memory fading... but I think the mschap v2 password change protocol was implemented in CSRadius.

However - the VPN server and supplicant would need to handle it too.

A microsoft supplicant should automatically work.In theory the VPN server should just pass the password change challenges back to the supplicant.

Lots of ifs and but Im afraid. See if anyone@cisco knows ;)

riteshmalpani · ‎07-01-2009

Hi

I have done TACACS+ settings with my ASA and have created External database (AD).

When the VPN user tries to Login , he gets the username and password prompt. But thereater no prompts for changing credentials. I have also done settings for user "change password at Next Logon" in AD" .

When I check ACS it Says the authentication failed and "Windows password change failed".

Please help in this

regards