Configuring the Local Reset Extension

The cgilocalr plugin updates local resources and runs commands after a web-based password change via Bravura Pass .

Usage

The cgilocalr plugin triggers local resource updates when a self-service password reset succeeds on a target system, as specified in cgilocalr.cfg.

To enable cgilocalr :

Requirements

The cgilocalr plugin requires a configuration file. The cgilocalr.cfg file in the samples\ directory includes example configurations for pslocalr and pgpfde. Copy the file to the \<instance>\script\ directory, then edit the configuration.

The generic control requires the following parameters for running arbitrary commands:

Customization

You can customize the user interface text in the plugin-pslocalr.m4 file. The plugin’s result messages can also be modified in this M4 file. See Customizing skins for more information.

Example

The cgilocalr plugin uses the configuration file to specify the target system and AD domain for which passwords should be changed locally, where:

For example, a company has an Active Directory Domain Controller managing the domain OFFICE. A target system for this domain controller has already been added with a target system ID of INTERNAL-AD. The following script configures the Local Reset Extension for passwords changed using the web-based interface. The user must be logged onto a workstation that is a member of the domain OFFICE. When the user changes his password on INTERNAL-AD the plugin will immediately update the user’s local Windows password cache.

# NOTE: This example is for backwards compatibility only, use of the
# pslocalr control directly should be changed to use the generic
# control as described in Generic Control example below.
#
# cgilocalr plugin config file to use pslocalr
 # KVGROUP-V2.0
 "" "" = {
   "targetid" "INTERNAL-AD" = {
     "control" "pslocalr" = {
       "protocol" = "2";
       "attributes" "" = {
         "logonDomain" = "OFFICE";
       };
     };
   };
 };

or

#
 # cgilocalr plugin config file to use generic control
 # KVGROUP-V2.0
 "" "" = {
   "targetid" "INTERNAL-AD" = {
    "control" "generic" = {
       "id" = "pslocalr";
       "arguments" = "ResetCachedPassword2 %HID_ENCRYPTED_DATA%";
       "attributes" "" = {
         "logonDomain" = "OFFICE";
       };
     };
   };
 };

Furthermore, workstation lock down after successfully updating the user’s local Windows password cache also can be configured by adding "useLockWstn" = "true" to the config file using the generic control. For example:

"" "" = {
  "targetid" "INTERNAL-AD" = {
    "control" "generic" = {
      "id" = "pslocalr";
      "arguments" = "ResetCachedPassword2 %HID_ENCRYPTED_DATA%";
      "attributes" "" = {
        "logonDomain" = "OFFICE";
        "useLockWstn" = "true";
      };
    };
  };
};

Testing

To test the correctness of the configuration file, attempt a password reset for one of the users on that system. If the syntax of the configuration file is invalid, the end user will not see any errors, but the server will log details about the parse error encountered:

Failed to parse file [C:\<path-to-instance>\script\cgilocalr.cfg]:
[Line: 36, Pos: 14]: Parse error: expected '='"

See also

Configuration example: SSA Login Assistant with VPN includes an example that enables the Local Reset Extension to function using the Chrome web browser.

A Chrome Bravura Security browser extension as well as a native extension is required to reset a user’s password cache on a workstation when using either Chrome or Edge Chromium. A download link will be available to install the extensions if they have not been installed yet.

In cases where users are not able to install extensions on their web browsers, an organization's administrators would need to:

Manual install works only for normal user accounts that are allowed to download and install browser extensions. It will not work inside the Login Assistant’s Secure Kiosk Account (LA/SKA) which is triggered from the login screen’s Credential Provider.

To install the Bravura Security browser extension and native extension as an end user:

Next:

Test the installation

A Bravura Security browser extension as well as a native extension is required to reset a user’s password cache on a workstation when using Firefox. A download link will be available to install the extensions if they have not been installed yet.

In cases where users are not able to install extensions on their web browsers, an organization's administrators would need to:

Manual install works only for normal user accounts that are allowed to download and install browser extensions. It will not work inside the Login Assistant’s Secure Kiosk Account (LA/SKA), which is triggered from the login screen’s Credential Provider.

To install the Bravura Security browser extension and native extension as an end user:

Next:

Test the installation