How-To: Setting up the Self-Service App for UCS@school environments

Knowledge Base Community
, ,
1

This guide gathers essential steps - which are otherwise spread across different manuals - for setting up the Self-Service App for UCS@school-environments, including two common customer scenarios (activating ‘Password forgotten’ and ‘Password Wireless LAN’):

Installation of Self-Service App

Scenario 1: Activate ‘Password forgotten’ (via e-mail)

Users are enabled to reset their forgotten password by requesting a token to be sent to a previously registered contact email address.

  • To activate the ‘Forgot password’ module on the Primary Directory Node: ucr set umc/self-service/passwordreset/backend/enabled=true (see 6.5. User self services — Univention Corporate Server - Manual for users and administrators)
  • NOTICE: Further configurations need to be considered before the function can be fully utilized:
    • Depending on the desired user story the recovery option should be specified. The options available are e-mail (umc/self-service/passwordreset/email/enabled is set to yes by default), SMS (umc/self-service/passwordreset/sms/enabled) or a self-defined sending process (umc/self-service/passwordreset/external/enabled).
    • Further configuration of the e-mail (subject, text, etc.) is possible via UCR variables:
      • UCR variable for the sender address of the token e-mail: umc/self-service/passwordreset/email/sender_address
      • UCR variable for token e-mail subject: umc/self-service/passwordreset/email/subject.
      • UCR variable for the name of the server used for links in the token e-mail: umc/self-service/passwordreset/email/webserver_address.
      • The message to be sent is generated from a text file. The UCR variable umc/self-service/passwordreset/email/text_file can be used to determine which one is to be used. To customize the text, the file with the standard text from /usr/share/pyshared/univention/management/console/modules/passwordreset/sending/email_body.txt should be copied somewhere and edited. The path to the new file is then set in the UCR variable.
      • For further details / more options see Self Service to Reset Password in UCS 4.1 (including comment section).
    • A recovery e-mail must also be supplied to the system by the users themselves. The easiest (and most data efficient) way to set this up is provided by the ‘Protect account’ module. To activate the module, execute ucr set umc/self-service/protect-account/backend/enabled=true on the Primary Directory Node.
    • Alternatively (or additionally?) the module ‘My profile’ can be activated to enable users to supply even more personal data themselves. For information about activation and configuration see 6.5. User self services — Univention Corporate Server - Manual for users and administrators.
    • For details how to customize the description of fields in the web interface of Self-Service modules (e.g. the title for the recovery e-mail field in the ‘Protect account’ module.) via the custom.css see How-to: Customize UCS web interfaces via CSS

Scenario 2: Activate ‘Password Wireless LAN’

By default, users authenticate with their domain password. By activating ‘Password Wireless LAN’ a dedicated password for RADIUS will be used. Through the Self Service App users can then get such a password. The system will generate a random password for users to use.

  • If not already done:
  • To activate the ‘Password Wireless LAN’ module (see 11.6. RADIUS — Univention Corporate Server - Manual for users and administrators):
    • On the Replica Directory Node with the RADIUS-App: ucr set radius/use-service-specific-password=true
    • On the Primary Directory Node (where the Self Service Backend was installed): ucr set umc/self-service/service-specific-passwords/backend/enabled=true
    • The parameters used to generate the passwords can be displayed with ucr search password/radius/quality on the nodes where the RADIUS app is installed. However, they can only be adjusted on the Primary Directory Node (even if the RADIUS app is installed on another system)(cf. here). The parameter configurations fulfill the ‘Microsoft requirements’ (also BSI):
      • Upper and lower case letters via password/radius/quality/credit/lower and password/radius/quality/credit/upper.
      • Digits via password/radius/quality/credit/digits.
      • Special characters via password/radius/quality/credit/other (can also be switched off completely via 0).
      • Limitation of the number of characters downwards (min. 8) via password/radius/quality/length/min.
      • Additionally: You can also exclude characters via password/radius/quality/forbidden/chars.
2

This topic was automatically closed after 24 hours. New replies are no longer allowed.