rnwolfe / cisco-ise-extension

A Google Chrome and Firefox Extension to expedite common Cisco ISE tasks.

Hello!

About Me

✍️ I started out programming, then I did networking and security, and now I do both. 🤷‍♂️

💻 I like to build full-stack applications and make the day to day lives easier for network and other infrastructure engineers using automation and programming.

🍹 I'm an avid craft cocktail hobbyist and at any time have a large amount of homemade liqueurs, infusions, and syrups. Check out some of my stuff here. As a result, when experimenting with new technologies, I use a cocktail recipe database as my go to example application.

🧩 I can solve a Rubik's cube in under 1 minute and 15 seconds. Working on getting below 1 minute 😤!

🏆 Certifications

🛠️ My Tech Stack

These are the technologies and languages I use often and have proficiency in.

Languages, Markups, Styling

Frameworks

Databases

The Rest

⭐ My Favorite Projects

📫 How to reach me:

cisco-ise-extension's Issues

add intro/update info tabs

provide feedback mechanism of successful group change

Likely through use of chrome.notifications API.

typo for ISE ERS Password field

https://github.com/rnwolfe/ise-extension-chrome/blob/1d2fc1d010bdc7834c9020f3a949c1220eb4c0a7/options.html#L39-L42

Should read: ISE ERS Password.

Fix ''tab' is defined but never used.' issue in background.js

CodeFactor found an issue: 'tab' is defined but never used.

It's currently on:
background.js:20
Commit 56415d8

split settings for PAN/MNT given ERS / MNT API are on different personas

This will support distributed deployments instead of just "all on one" node deployments with the add of CoA support (#25)

refactor to support both chrome and firefox

trim whitespace off of selected text

Given a MAC address can easily be selected with undesired whitespace before/after it, automatically trim it off so that the selected text doesn't have to be perfect to run correctly.

related to #1, can fix at same time

validate selected text to ensure it is a mac address

The selected text that is passed to the extension is not currently validated before being used for ISE REST calls. This should be done to prevent unnecessary calls, as well as for general security practices.

add icon for button

password is stored using chrome.storage

Using the chrome.storage API is useful for the non-sensitive values since it persists in the Chrome runtime even if you close/re-open Chrome.

Unfortunately, chrome.storage does not seem to use any type of security and if the user's home directory is stolen, Chrome can be manually booted with those settings and make use of these settings. This doesn't necessarily mean they are stored is regular plain text; however, it does present a security concern.

Frankly, I'm not certain of the appropriate/accepted way of handling passwords in a chrome extension. Unfortunately, due to the use of Basic authorization in the ISE REST API, there's really no getting around having a base64 encoded string of the username/password (which can easily be decoded), or the actual username/password that will be used to produce the base64 encoded string used for Basic authorization.

extension does not initiate successfully when installing from chrome web store

No console logging to show extension starting or context menu getting built.

I suspect this is an issue with chrome.runtime.onInstalled.addListener that kicks off the whole extension.

use progress type notification for bulk updates

Can we consider using the progress type notification for bulk updates instead of having a barrage of update?

Failures can still send an additional notification of failure (perhaps with bulk updates a failure report should be produced so those MACs can be investigated?)

add ability to issue coa for an endpoint from right-click menu

format context menu items with consideration for identity group hierarchy

By default, all ISE deployments will have a hierarchy for profiled identity groups. In the context menu, these aren't distinguishable from any others. Additionally, the identity group hierarchy can take any number of structures.

Re-structure group retrieval and handling

The identity groups retrieved from ISE were originally limited to 20 (the default per API request), but were updated to 100 (the max per API request). Now, the list can grow to beyond the number of items that can fit on the screen without scrolling. This is poor.

I need to update the retrieval to retrieve all groups (go through entire pagination), but also better handle group structure in the right-click context menu. The easiest way to do that is to create a sub-menu for each letter of the alphabet and sort the groups into relevant sub-menus. Given this would be excessive for small groups lists, this should only be done when the group list is too long (above 40, for example).

beautify the options.html page

add support for assigning ANC Policies

Do more testing on performance / is rate limiting or bottlenecking required

make extension options configurable in options window

As is in the example Google Global Search here.

This will require the use of chrome.storage.

selecting text from previous line works in some cases

modify regular expressions to prevent this from happening

display new group name in success notification

Right now, the group's UUID is shown because that's the only information we have accessible at the time.

The simplest way would be to just regurgitate the text that was displayed on the menu item the user clicked; however, the chrome.contextMenus API doesn't provide that information onClick. So, all we have is the UUID.

While it would be useful to confirm to the user that the correct group was actually used, is it worth the extra API call on each move request to show it?

Options

• Make API call to get group name from UUID.
• Remove reference to which group the endpoint was moved into at all: [MAC] was successfully added to group!
• Store groups locally in chrome.storage with { uuid: name } format on runtime start when building menu. Then lookup in chrome.storage when calling notification.

create README

implementing bulk move feature broke single mac move functionality

add support for bulk endpoint update

Support for bulk operations in list of only MAC addresses, e.g.

00:00:00:00:00:01
00:00:00:00:00:02
00-00-00-00-00-03
00-00-00-00-00-04
0000.0000.0005
0000.0000.0006

Also support for MACs in a list of random data (extract MACs from data) as if highlighting from Context Visibility or Live Logs page, e.g.

00:00:00:00:00:01
Xerox-Device
 	
00:00:00:00:00:02

add ability to show session details for selected mac

This would presumably be displayed via a new tab.

create useful notification for unauthorized PUT request

The extension currently errors for HTTP 401 status code on the initial menu build, but a use could have enough permissions to retrieve the groups (and even retrieve endpoint information), but not enough to change them.