Local Reset Extension: Resetting cached credentials

The cgilocalr plugin updates local resources and runs commands after a web-based password change via Bravura Pass .

Usage

The cgilocalr plugin triggers local resource updates when a self-service password reset succeeds on a target system, as specified in cgilocalr.cfg.

To enable cgilocalr :

Requirements

The cgilocalr plugin requires a configuration file. The cgilocalr.cfg file in the samples\ directory includes example configurations for pslocalr and nplocalr. Copy the file to the \<instance>\script\ directory, then edit the configuration.

The generic control requires the following parameters for running arbitrary commands:

Customization

You can customize the user interface text in the plugin-pslocalr.m4 file. The plugin’s result messages can also be modified in this M4 file. See Customizing skins for more information.

Example

The cgilocalr plugin uses the configuration file to specify the target system and AD domain for which passwords should be changed locally, where:

For example, a company has an Active Directory Domain Controller managing the domain OFFICE. A target system for this domain controller has already been added with a target system ID of INTERNAL-AD. The following script configures the Local Reset Extension for passwords changed using the web-based interface. The user must be logged onto a workstation that is a member of the domain OFFICE. When the user changes his password on INTERNAL-AD the plugin will immediately update the user’s local Windows password cache.

# NOTE: This example is for backwards compatibility only, use of the
# pslocalr control directly should be changed to use the generic
# control as described in Generic Control example below.
#
# cgilocalr plugin config file to use pslocalr
 # KVGROUP-V2.0
 "" "" = {
   "targetid" "INTERNAL-AD" = {
     "control" "pslocalr" = {
       "protocol" = "2";
       "attributes" "" = {
         "logonDomain" = "OFFICE";
       };
     };
   };
 };

or

#
 # cgilocalr plugin config file to use generic control
 # KVGROUP-V2.0
 "" "" = {
   "targetid" "INTERNAL-AD" = {
    "control" "generic" = {
       "id" = "pslocalr";
       "arguments" = "ResetCachedPassword2 %HID_ENCRYPTED_DATA%";
       "attributes" "" = {
         "logonDomain" = "OFFICE";
       };
     };
   };
 };

Furthermore, workstation lock down after successfully updating the user’s local Windows password cache also can be configured by adding "useLockWstn" = "true" to the config file using the generic control. For example:

"" "" = {
  "targetid" "INTERNAL-AD" = {
    "control" "generic" = {
      "id" = "pslocalr";
      "arguments" = "ResetCachedPassword2 %HID_ENCRYPTED_DATA%";
      "attributes" "" = {
        "logonDomain" = "OFFICE";
        "useLockWstn" = "true";
      };
    };
  };
};

Testing

To test the correctness of the configuration file, attempt a password reset for one of the users on that system. If the syntax of the configuration file is invalid, the end user will not see any errors, but the server will log details about the parse error encountered:

Failed to parse file [C:\<path-to-instance>\script\cgilocalr.cfg]:
[Line: 36, Pos: 14]: Parse error: expected '='"

See also

Configuration example: SSA Login Assistant with VPN includes an example that enables the Local Reset Extension to function using the Chrome web browser.

A Chrome Bravura Security browser extension as well as a native extension is required to reset a user’s password cache on a workstation when using either Chrome or Edge Chromium. A download link will be available to install the extensions if they have not been installed yet.

In cases where users are not able to install extensions on their web browsers, an organization's administrators would need to:

Manual install works only for normal user accounts that are allowed to download and install browser extensions. It will not work inside the Login Assistant’s Secure Kiosk Account (LA/SKA) which is triggered from the login screen’s Credential Provider.

To install the Bravura Security browser extension and native extension as an end user:

Next:

Test the installation

A Bravura Security browser extension, as well as a native extension, is required to reset a user’s password cache on a workstation when using Firefox. A download link will be available to install the extensions if they have not been installed yet.

In cases where users are not able to install extensions on their web browsers, an organization's administrators would need to:

Manual install works only for normal user accounts that are allowed to download and install browser extensions. It will not work inside the Login Assistant’s Secure Kiosk Account (LA/SKA), which is triggered from the login screen’s Credential Provider.

To install the Bravura Security browser extension and native extension as an end user:

Next:

Test the installation

This section shows you how to manually install the native extension using the Windows Installer.

See Installing add-on software for general requirements for using a client MSI installer, configuring ActiveX security, and instructions for automatic installation using a group policy.

The installers are included in the addon directory:

To manually install the native extension:

Excluding users and groups

The pslocalr.msi and pslocalr-x64.msi installers allow you to customize the installation by specifying users and groups that are to be excluded from cached-credential resets. You can also set this list manually, by modifying appropriate registry settings:

For Windows 32-bit or Windows 64-bit (64-bit pslocalr):

HKLM\SOFTWARE\Bravura Security\Bravura Security Fabric\Local Reset Extension\EXCLUDED_USERS

HKLM\SOFTWARE\Bravura Security\Bravura Security Fabric\Local Reset Extension\EXCLUDED_GROUPS

For Windows 64-bit (32-bit pslocalr):

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Bravura Security\Bravura Security Fabric\Local Reset Extension\EXCLUDED_USERS

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Bravura Security\Bravura Security Fabric\Local Reset Extension\EXCLUDED_GROUPS

Installing the Local Reset Extension automatically on a browser

Automatic download occurs when a target system is configured to use the local reset extension, and the user clicks Change password in the Change passwords (PSS) module. If the ActiveX control is already installed, and a newer version is installed on the server, the control is automatically upgraded.

To use the download method, users must have administrative access to install and register the ActiveX control. If administrative access to install is not available, you must install the ActiveX controls using the MSI installer.

To install the ActiveX control on a browser as an end user: