topic Re: Captive Portal & Active Directory Password Change in General Topics

Captive Portal & Active Directory Password Change

daz1981dp — Tue, 19 Jun 2012 14:32:42 GMT

Hello, we are currenlty using captive portal for pupil laptops and mobile devices that are not joined to the domain to authenticate for internet access.

Does anyone know if you can use or setup captive portal that is a users active driectoy account and been set to change that this can be done via captive portal with out them having to go to a school pc joined to the domain just to change there password.

we are currenlty running pan os 4.1.6.

Many Thanks

Darren

Re: Captive Portal & Active Directory Password Change

sebastian — Mon, 05 Nov 2012 09:26:24 GMT

No Answer from PAN.

dislike!!! :smileyminus:

Same question in here!

Re: Captive Portal & Active Directory Password Change

sdurga — Tue, 06 Nov 2012 04:08:29 GMT

I am not sure if I have got the question right but as far as I can understand you are looking to change the password of the users belonging to an active directory from the captive portal page, which is not possible. let me know if I got it wrong or you need more information.

Thanks,

Sandeep T

Re: Captive Portal & Active Directory Password Change

sebastian — Tue, 27 Nov 2012 16:52:56 GMT

Hi Sandeep,

that was the question.

Are there any plans to fix/implement this?

Because we are using the captive portal for a lot of external consultants they are temporary working for us with their own equipment.

At the moment we have to ask them to logon with their AD-Account and the password given bye us to a machine in our company so that they are able to change the password first.

Sebastian

Re: Captive Portal & Active Directory Password Change

mikand — Tue, 27 Nov 2012 17:36:50 GMT

That sounds somewhat risky because the PA would need to be domain admin in order to change passwords of users (or whatever that role is called nowdays in AD) but should be doable if you add a custom link to the captive portal page which goes to your internal server (on DMZ or such) where you have a script that takes username, current pass and new pass as input (and hopefully some other security measures on the road).

Re: Captive Portal & Active Directory Password Change

BobW — Wed, 28 Nov 2012 02:38:21 GMT

One trick I have used in a similar situation is using Outlook Web Access. Users can change password from there.

Bob

Re: Captive Portal & Active Directory Password Change

essnet — Wed, 28 Nov 2012 17:03:09 GMT

you don't need to be domain admin to change password. you generate a token from old password with new password and it's done.

PA doesn't handle complex AD stuff right now : they simply pass tokens without really analysing them. May be a feature request could help in mid term future

Re: Captive Portal & Active Directory Password Change

mikand — Wed, 28 Nov 2012 20:52:17 GMT

Yeah, sorry... dunno where that brainfreeze came from.

Of course one only need current user/pass to alter the password of a specific user 🙂