Managing Desktop Password Reset on Windows

This section provides details to effectively manage and configure DPR using the built-in configuration utility, and learn best practices for securely deploying and updating DPR settings on Windows.

Managing Chromium Embedded Framework Updates

Desktop Password Reset uses Chromium Embedded Framework (CEF) for Restricted Browser. CEF releases patches to address various issues and reported vulnerabilities. In an effort to ensure all DPR setups run with the latest version of CEF, SailPoint provides an option to update the CEF version. The latest release (as well as previous versions) of CEF run-time can be downloaded and installed on the master machine, then later distributed to all remote systems. For more information on distributing the updated configuration to remote systems, refer to Distribute Updated Configurations to Remote Systems.

To update CEF dependencies:

1. Go to <pathOfDesktopPasswordReset>\SailPoint Technologies\Desktop Password Reset on the master system or the system where Configuration Utility is installed.

2. Run configurator.exe as an Administrator.

3. Select the Advanced tab.

4. Select Download Latest > Download to download the latest available version of Browser Engine run-times.

   This downloads the latest version of CEF version from the Microsoft NuGet site.

5. Select Save to install the downloaded engine run-times. This updates the CEF dependencies used by the DPR browser.

   Note

   In case of compatibility issues with latest version of CEF, a specific version of CEF can be downloaded using the Download Specific Version option. Contact SailPoint Support for guidance on specific versions of CEF.

To distribute the updated configuration to remote systems, refer to Distribute Updated Configurations to Remote Systems.

Desktop Password Reset Configurations

Desktop Password Reset has a simple built-in configuration utility that facilitates configuration updates.

If it is necessary to change the value of the configuration parameters for Desktop Password Reset, go to master system or the system where Configuration Utility is deployed. Update the desired attributes and select Save to store your changes.

Distribute Updated Configurations to Remote Systems

To update the configurations on all remote systems, perform the following:

1. On the master system or the system where Configuration Utility is installed, open command prompt as an Administrator.

2. In command prompt, go to pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset.

3. Run the following command and press Enter:

   Configurator.exe -exportconfig -exportkey
   

   This creates three files at that location:

   • dprconfig.export
   • dprkey.export files
   • browserruntime.zip

4. Copy the new files to the remote system at pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset.

5. In command prompt, go to pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset.

6. Run the following command at the end users system:

   PwdResetBrowser.exe -importconfig -importkey
   

7. Delete all instances of the dprconfig.export, dprkey.export, browserruntime.zip, and bouncycastleruntime.zip files.

Encrypting Configurations

Encryption keys are used to encrypt the configurations before they are stored in the Windows registry of the respective system. To generate or regenerate these keys:

1. Go to pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset on the master system or the system where Configuration Utility is installed.

2. Run configurator.exe as an Administrator.

3. Select the Advanced tab.

4. To generate or regenerate the encryption key, select Generate/Regenerate Encryption Key.

5. Select Save to save the settings. This regenerates the Encryption Key as well as re-encrypts currently stored configurations with the new key.

To distribute the updated configuration to remote systems, refer to Distribute Updated Configurations to Remote Systems.

Custom ToolTip for Desktop Password Reset

The Desktop Password Reset tile displays after selecting the Sign-in options link on the Logon screen. When users hover their cursor over the DPR tile, it displays a tooltip with more information. You can customize the message that displays in the tooltip. To configure the tooltip message:

1. Go to pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset on the master system or the system where Configuration Utility is installed.

2. Run configurator.exe as an Administrator.

3. Select the Basic tab.

4. Update the value for the Tool Tip Text on Tile configuration. The maximum allowed length of the text is 45 characters.

5. Select Save.

To distribute the updated configuration to remote systems, refer to Distribute Updated Configurations to Remote Systems.

Configure Allowed Domains

This configuration lists domain names, other than domain of the base URL, which should be allowed for navigation from the Restricted Browser. The values must be separated by a semicolon (;). If not specified, only pages from the base URL domain are accessible from Restricted Browser.

To modify value of this configuration, perform the following:

1. On the master system or the system where Configuration Utility is installed, go to pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset.

   Master system refers to the primary administrative system that is responsible for installing DPR and deploying it remotely to all other machines in the network using System Center Configuration Manager (SCCM).

2. Run configurator.exe as an Administrator.

3. Select the Advanced tab and update the value for Allowed Domains configuration.

   The value must be in the following format:

   <Domain1>;<Domain2>
   

   For example, if the URL is set to https://abc.sailpoint.com/passwordreset and it is required to access web pages from a domain other than abc.sailpoint.com, the value of this attribute can be set to:

   example1.com;example2.com
   

4. Select Save to save the settings.

To distribute the updated configuration to remote systems, refer to Distribute Updated Configurations to Remote Systems.

Enabling Logs

By default, logs are not enabled for the Desktop Password Reset. To enable logs or change the traceability level for the Desktop Password Reset, modify the Trace Level option from configurator utility.

To modify values in the Configurator Utility to enable logs, perform the following:

1. On the master system or the system where Configuration Utility is installed, go to pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset.

   Master system refers to the primary administrative system that is responsible for installing DPR and deploying it remotely to all other machines in the network using System Center Configuration Manager (SCCM).

2. Run configurator.exe as an Administrator.

3. Select the Advanced tab and set one of the following values for the Log Level:

   • Off - Disable logs
   • Error - Enable logging of Errors.
   • Warning - Enable logging of Warnings and Errors.
   • Info - Enable logging of errors ,Warnings and other detailed information helpful for troubleshooting.

4. Select Save to save the settings.

To distribute the updated configuration to remote systems, refer to Distribute Updated Configurations to Remote Systems.

Enabling Wrapping for Third-Party Credential Providers

There may be situations where multiple credential providers are required to compliment each other to produce the required functionality on a single logon tile. In such cases, one credential provider wraps other credential providers. SailPoint Desktop Password Reset Credential Provider provides an option to wrap other credential provider for achieving similar effect subject to compatibility of other credential providers.

The following section describes the procedure for enabling a wrapper for third-party credentials with the Windows registry by adding the obtained WrapCPGuid string value to the Desktop Password Reset.

To find the global unique identifier (GUID) for the third-party credential provider, perform the following:

1. From the command prompt, enter the regedit command to open the Windows registry.

2. Locate the currently installed credential providers at the following location:

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers.
   

3. Copy the GUID key for the credential provider that must be wrapped, including the curly brackets.

To enable wrapping for credential providers by adding the WrapCPGuid string value to the Config registry of Desktop Password Reset, perform the following:

1. Go to the following Windows registry location:

   HKEY_LOCAL_MACHINE\SOFTWARE\SailPoint Technologies\Desktop Password Reset\Config
   

2. Add a new string value: WrapCPGuid

3. Enter values for the WrapCPGuid string value: <GUID Key>

   The <GUID Key> is the GUID key for the Credential Provider obtained earlier.

To distribute the updated configuration to remote systems, refer to Distribute Updated Configurations to Remote Systems.

Changing the Default Credential Provider

By default, Desktop Password Reset is set as the default Credential Provider. To change the default Credential Provider, modify the Use SailPoint as Default Credential Provider option from the configuration utility.

To change the default credential provider, perform the following:

1. On the master system or the system where Configuration Utility is installed, go to pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset.

2. Run configurator.exe as an Administrator.

3. Select the Advanced tab and deselect the Use SailPoint as Default Credential Provider setting to remove SailPoint Credential Provider from Default.

4. Select Save to save the settings.

To distribute the updated configuration to remote systems, refer to Distribute Updated Configurations to Remote Systems.

Managing Bouncy Castle Cryptography Library

Desktop Password Reset (DPR) relies on the Bouncy Castle cryptography library to securely handle encrypted password data. Bouncy Castle is used to encrypt and decrypt critical sections of the credential cache. Updates are released periodically to improve cryptographic functionality and ensure compatibility with the latest security standards.

To ensure the DPR setup uses the latest cryptographic standards, SailPoint provides an option to update the Bouncy Castle version. You can download the latest version or a specific version on the master machine and then distribute it to all remote systems.

To update the Bouncy Castle dependencies, complete the following steps:

1. On the master system or the system where the Configuration Utility is installed, go to

   pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset
   

2. Run configurator.exe as an administrator.

3. Select the Advanced tab.

4. To download the latest available version of the Bouncy Castle dependency, select Download Latest, and then select Download. This downloads the latest Bouncy Castle Cryptography version from the Microsoft NuGet site.

5. Select Save to install the downloaded Bouncy Castle dependency run-time. This updates the Bouncy Castle dependencies used by DPR.

To distribute the updated configuration to remote systems, refer to Distribute Updated Configurations to Remote Systems.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.