1. Presentation_ID © 2012, Cisco Systems, Inc. All rights reserved. Cisco Confidential

2.  Existing Functionality in Connection  What’s New  CLI to provision Time Interval and Flag against Authentication Rule  Behavior of the Conversation Prompts based on Flag and Time Interval.  Troubleshooting Tips

3. ‣There is a configuration on CUCA page to set the number of expiry warning days and number of days after which the credential will expire. ‣In the current implementation if the number of expiry warning days are set to N then prompt of expiry warning will be played every day on each login to the user till N days. ‣Playing the warning on each login till N number of days increases the overhead to user. Presentation_ID © 2012, Cisco Systems, Inc. All rights reserved. Cisco Confidential

4.  To reduce the frequency of warning being played every time. New CLI is being introduced that will enable and disable the feature.  With the help of CLI,administrator can set the warning flag and time interval during which Expiry warning will be played.  CLI Command is : utils cuc set PinExpiry_PromptTime “Authentication Rule Name”  Authentication Rule Name is the Rule Associated with the user,warning flag and time interval will be set against this Rule.  Time interval (based on system time zone) configured by administrator is associated with Authentication Rule,not per user basis.  Configured time interval value is mapped with the local timezone associated with the user and accordingly expiry warning prompt is played/echoed. Presentation_ID © 2012, Cisco Systems, Inc. All rights reserved. Cisco Confidential

5. Flag (0/1)Time IntervalFrequency of Prompts 0N.A.Default Behavior(Existing functionality Keeps working). Play the warning on each login till N days, if expiry warning days are set to N. 1N.A.Play the warning on each login on 30 th,15 th,5 th -1 st days of the Pin Expiration Warning Days.** 1Time Interval set i.e say (10:00- 12:00) 1) Play the expiry warning prompt on 30 th,15 th,5 th - 1 st day of Pin Expiration Warning Days on each login.** 2) On other days,for “PinExpirationDays less than or equal to PinExpiryWarningDays and greater than zero”, conversation would play the PinExpiry Warningprompt in the specified interval every time user logs in.

6. CLI & Conversation Behavior utils cuc set PinExpiry_PromptTime “Authentication Rule Name” Presentation_ID © 2012, Cisco Systems, Inc. All rights reserved. Cisco Confidential

7.  Set the Warning Flag as ‘1’ and Time Interval say 12:00-23:00  Conversation will play the expiry warning prompt on 30 th,15 th,5 th -1 st day of Pin Expiration Warning Days on each login.  On days other than mentioned above,for “PinExpirationDays less than or equal to PinExpiryWarningDays and greater than zero”, conversation would play the PinExpiryWarningprompt in the specified interval every time user logs in.

8. ‣ Set the Warning flag as ‘0’. o Disabling the feature o Conversation will behave as per existing implementation, it will play the warning prompt on each login to the user till N days, if the number of expiry warning days are set to N. ‣ Set the warning Flag as ‘1’. o No Time Interval is entered. o Conversation will play the expiry warning prompt on 30 th,15 th,5 th -1 st day of Pin Expiration Warning Days on each login. Presentation_ID © 2012, Cisco Systems, Inc. All rights reserved. Cisco Confidential

9. Example:  Setting Warning Flag as ‘1’ and admin has entered the time range like 12:00- 10:00  Above range means 12:00-23:59 and 00:00-10:00.  User logs on say when PIN expiry warning days left are 10,then Expiry Warning Prompt will be played in the time range 12:00-23:59 and 00:00- 10:00 on that day

10.  CDL Traces 12:51:02.832 |22080,PhoneSystem-1- 001,3FD57374162C44EC8EDD934F48628DB4,CDL,10,CCsCdlCommon::DbQuery: Executed query select (ExpiryWarningInterval),(WarningFlag) from UnityDirDb:vw_credentialpolicy where (Objectid) = ?; Got 1 matches; Processing Time(millisec): 1 12:51:02.832 |22080,PhoneSystem-1- 001,3FD57374162C44EC8EDD934F48628DB4,CDL,10,CCsCdlCommon::GetData: Retrieved Column: ExpiryWarningInterval from CCsRow; Type: 7 12:51:02.832 |22080,PhoneSystem-1- 001,3FD57374162C44EC8EDD934F48628DB4,CDL,10,CCsCdlCommon::GetStringData: Retrieved Column: ExpiryWarningInterval from recordset; Value: 12:00-02:00 12:51:02.832 |22080,PhoneSystem-1- 001,3FD57374162C44EC8EDD934F48628DB4,CDL,10,CCsCdlCommon::GetData: Retrieved Column: WarningFlag from CCsRow; Type: 2 12:51:02.832 |22080,PhoneSystem-1- 001,3FD57374162C44EC8EDD934F48628DB4,CDL,10,CCsCdlCommon::GetLongData: Retrieved Column: WarningFlag from recordset; Value: 1

11. 12:51:02.832 |22080,PhoneSystem-1- 001,3FD57374162C44EC8EDD934F48628DB4,ConvSub,1,CheckForExpirationWarnin g_OnEntry: warning flag:[1],warningInterval:[12:00-02:00] [Src/SubAuthenticate.cpp:3005] 12:51:02.832 |22080,PhoneSystem-1- 001,3FD57374162C44EC8EDD934F48628DB4,ConvSub,1,CheckForExpirationWarnin g_OnEntry: Credential policy calls for PIN expiration warning [8] days in advance of expiration. [Src/SubAuthenticate.cpp:3007] 12:51:02.832 |22080,PhoneSystem-1- 001,3FD57374162C44EC8EDD934F48628DB4,ConvSub,1,CheckForExpirationWarnin g_OnEntry: Credential expires in [8] days. [Src/SubAuthenticate.cpp:3034] 12:51:02.834 |22080,PhoneSystem-1- 001,3FD57374162C44EC8EDD934F48628DB4,ConvSub,1,ComputeWarning_Interval: StartTimeinterval:[2013-06-17T12:00] and EndTimeinterval:[2013-06-17T02:00] is Configured by the Administrator for Conditional Warning Prompt Play [Src/SubAuthenticate.cpp:2955] 12:51:02.836 |22080,PhoneSystem-1- 001,3FD57374162C44EC8EDD934F48628DB4,ConvSub,1,CheckForExpirationWarnin g_OnEntry: Conditional warning Prompt Play is Enabled for Expiration Warning Day[8] during WarningInterval:[12:00-02:00] [Src/SubAuthenticate.cpp:3099]

12. ‣ If value other than ‘0/1’ is entered,Error displayed will be “Invalid Response” ‣ If admin entered a wrong Time Interval other than 24 hr format,then Error message thrown is “Time Interval Invalid!!” ‣ Valid time format is 24 hrs(hh:mm-hh:mm) i.e. (12:00-22:00).No other format is accepted. ‣ If admin entered wrong “Authentication rule name”.Error Message thrown on CLI is Invalid Authentication Rule Name Object not found. Object = [Credential policy], Table = [tbl_Credential Command failed ‣ While setting the Warning Flag and Time interval via CLI for a particular Authentication Rule, ensure that ‘User’ must be associated with that ‘Authentication rule’. ‣ For more details refer to diag_CuCsMgr_00* traces by enabling the CDL,ConvSub Microtraces.

13.  EDCS link:http://wwwin- eng.cisco.com/Eng/VTG/UCBU/Unity_Connection/ Oz/Program_Plans/Cisco_IT_Pin_reset_US- Design_Document.docx  EDCS -1230807  Documentation Link: To be Shared Later …CCO posting Presentation_ID © 2012, Cisco Systems, Inc. All rights reserved. Cisco Confidential