Re: Unity 3.1(5) Blank Password

xhemery · ‎08-27-2003

Hi,

The unity server is configured to allow blank password. It is a customer request.

However, when a user calls his voicemail, he is still met by the "connection" audio menu, which prompts him for the password.

My guess is then to press the # key, but as soon as te # key has been pressed, the user is back at the "MAIN" menu, whereas you would expect to enter the user voicemail.

1: can you "override" the connection menu? ie: no voice prompts you for any password?

2: how can you actually login if the # key is misunderstood? Is it a bug?

Regards,

Xavier

lindborg · ‎08-27-2003

I suspect strongly your confusing User ID and Password. If it was really asking you for a password and you hit # it would tell you the password was invalid and ask you to try again. If, instead, it was asking you for your ID and you hit # it takes you back to the opening greeting which is what it's supposed to do.

Unity needs to know who you are and I suspect that your direct call or however you're getting to the subscriber login menu is not providing that to us accurately so we're falling back and asking you to enter your ID - try entering the ID of a user - I'll bet it'll just log them in since if you have a blank password for a user we will allow that.

Note that this is a mind-numbingly bad idea that you should strongly advise your customer against in the most strident terms you can. They might as well take an ad out in the local paper begging people to call in and listen to everyone's sensitive messages over the phone... really, really bad idea.

xhemery · ‎08-27-2003

It is Really asking me the password (please enter your password).

I tried going to the main subscriber login menu (by pressing *), enter the user ID followed by #, but then it still prompts me for a password, even though the PW of this user is blank.

That's where the problem is.

I press # ( to validate a blank password, not UserID, at this stage), and it brings me to the main unity menu.

They are actually using their phones/voicemail for emergency issues, and they need to get access to their voicemail asap, whithout any authentication.

lindborg · ‎08-27-2003

poking around I think you're hitting this bug:

http://www.cisco.com/cgi-bin/Support/Bugtool/onebug.pl?bugid=CSCdy65731&Submit=Search

Unfortunately there's no public release notes on that - basicaly it's an SA bug where it's not writing the blank password back through and it's leaving whatever phone password was set in the database alone.

To get around this you can use BulkEdit to force subscriber's passwords to blank - I can't remember when I added that option but you can run out and get the latest 3.x version of BulkEdit off www.CiscoUnityTools.com - on the password tab for subscribers it lets you check a box to force passwords to blank.

xhemery · ‎08-28-2003

I tried The Bulk Edit tool.

I checked the box, and left the field blank.

There was no error in the log.

When I try to log the user, it is still doing the same thing when I type #.

I noticed however that login was successful with the default PW, 12345. (whereas the bulkedit modification was definitely successful).

I think I'll just open a case on this.

xhemery · ‎08-28-2003

HI,

Just to let you know I solved the problem.

I deleted all the users and recreated them with a defauklt password set to blank. Only then the system automatically logs in the user without asking for the password.

I guess it is a variable that is not set to a "blank" value and therefore when the system looks up for the password value is finds the "old" value.

Thanks very much for you help and counsels.

Regards,

Xavier.

lindborg · ‎08-28-2003

Curious - I tried BulkEdit on 3.1(5), 4.0(1) and 4.0(3) and it worked for this scenario flawlessly on all systems. It's the DTMFPW column on the subscriber table that needs to be set to blank (it'll be a MD5 hash of a the phone password otherwise) - you can check and see if that's being updated properly or not.