1. Network Element Password Audit and Alignment#

1.1 Objective#

You need a reliable way to enforce your organization’s passwords on many devices—without manual spot checks, risky ad-hoc fixes, or “hope it’s compliant” assumptions. In this activity, you’ll use a custom, two-phase Device Operation built on NSP’s Large-Scale Operation Manager (LSOM) to:

• Detect non-compliant device user passwords at scale (validation phase).
• Reconcile only where needed, safely and predictably (fix phase).

The outcome is a repeatable, operator-friendly control you can run on any set of targets nodes to continuously check and enforce device-level passwords to be set correctly and update if needed.

1.2 Technology explanation#

Device Operation in NSP are tools that help manage network devices. They can do many things, like checking device settings, making backups, restoring data, or upgrading software.

These operations run through workflows — think of them like step‑by‑step instructions. Another part of NSP, called LSOM, oversees running those workflows, keeping track of their progress, and giving you control over when and how they run.

An operation always targets one or more devices. To run it, the workflow needs to know the device’s ID (called ne-id). In our case, since we’re managing device user accounts, we also need a username and password.

For our automation, we need to create three things:

1. A workflow to check if a device user’s password is correct.
2. A workflow to fix the password if it’s wrong.
3. An operation that ties these workflows together so they can be run easily.

To make sharing and installing these three parts simple, we’ll put them all together into one package called an Artifact Bundle.

The YAML syntax for writing workflows is very intuitive, as it uses simple English expressions to describe the execution and data flow including conditional statements. Please study the workflow code carefully to get used to the syntax and principles, soon you will write your first own workflow.

1.2.1 Artifact Bundle#

To build a device operation that runs multiple workflows, you need to follow a specific directory structure. Each file and folder in this structure has its own purpose, keeping the execution logic separate from the user interface so everything stays clean and well‑organized.

1.3 Tasks#

You should read these tasks from top-to-bottom before beginning the activity.

It is tempting to skip ahead but tasks may require you to have completed previous tasks before tackling them.

1.3.1 Getting Started#

Creating things from scratch can feel daunting and even overwhelming. To save you from piecing together all the required components that define the structure and format of an operation, we provide you with a LSO Skeleton Bundle Generator. This tool creates an artifact bundle in the exact structure expected by the system, giving you a ready-made starting point. From there, you can easily build upon it and move on to more advanced use cases.

1.3.2 Password Audit Workflow#

Part of monitoring local user configuration in a network element is being able to audit what is there. Let's create the workflow to audit the NE user password.

The general flow is the following:

1. Retrieve the current password from the NE
2. Compare it to the configured target password
3. Generate an audit result indicating compliance or deviation

To keep things efficient, we are providing you with the complete workflow code in the box below.

version: '2.0'

audit-misaligned-pass-<<GroupId>>:
  tags:
    - LSO

  input:
    - neId ## mandatory input for LSO operations
    - username ## NE User to validate
    - password ## Expected password

  output:
    lsoInfo: <% $.lsoInfo %> ## mandatory output for LSO operations
    misaligned: <% $.misaligned %> ## mandatory output leaf parameter defined in misaligned-pass.yang

  output-on-error:
    lsoInfo: <% $.lsoInfo %> ## mandatory output for LSO operations for errors
    misaligned: <% $.misaligned %> ## mandatory output leaf parameter defined in misaligned-pass.yang

  vars:
    lsoInfo: Failed
    lsoStageError: Unknown ## mandatory for LSO operations stage level errors
    misaligned: "no"

  tasks:
    checkUsernameIsAdmin:
      action: std.noop
      on-success:
        - avoidAdmin: <% $.username = "admin" %>
        - getAdminPass: <% $.username != "admin" %>

    avoidAdmin:
      action: std.fail
      publish-on-error:
        lsoInfo: "Info: Admin user cannot be used as input"
        lsoStageError: Admin user cannot be used as input

    getAdminPass: ## access the configured hashed password via MDC API
      action: nsp.https
      input:
        url: https://restconf-gateway/restconf/data/network-device-mgr:network-devices/network-device=<% $.neId %>/root/nokia-conf:/configure/system/security/user-params/local-user/user=<% $.username %>
        resultFilter: $.content.get("nokia-conf:user").first().password
      publish:
        nePass: <% task().result.content %>
        lsoInfo: <% task().result.content %>
      publish-on-error:
        lsoInfo: "Error: Failed to get <% $.username %> user password"
        lsoStageError: <% task().result %>
      on-success:
        - checkMisalignment

    checkMisalignment: ## Check alignment of configured password with the password provided as input
      action: nsp.python
      input:
        context: <% [$.password, $.nePass] %>
        script: |
          import bcrypt
          if bcrypt.checkpw(context[0].encode("utf-8"), context[1].encode("utf-8")):
            return "no"
          else:
            return "yes"
      publish:
        misaligned: <% task().result %>
        lsoInfo: <% task().result %>
      publish-on-error:
        lsoInfo: "Error: Failed to check for misalignment"
        lsoStageError: <% task().result %>
      on-success:
        - adminPassAligned: <% $.misaligned = "no" %>

    adminPassAligned: ## handle misalignment information
      action: std.fail
      publish-on-error:
        lsoInfo: "Info: Password of <% $.username %> user is aligned"
        lsoStageError: Password of <% $.username %> user is aligned

A few observations worth noting:

• Some specific rules need to be adhered to for the workflow to be valid LSO. Have a look at how the variables lsoInfo and lsoStageError are used. Those variables provide a feedback loop to Device Operations to understand execution progress and reasoning of the result.
• NSP uses the admin user for mediation (CLI, xFTP, NETCONF and gRPC). As we don't want to break your lab, an initial check is done to avoid updating the admin user's password by accident.
• The workflow input must fit the needs of the operation, so it needs to match the operation model. Alternatively, values could be set statically in the mapping profile.
• The general logic in LSO is that only targets that have successfully passed one phase are considered for the execution of the next phase(s). That's why we need to think carefully about the returned execution state. If and only if the check was executed successfully and we found a misalignment will the workflow return success. In other words, only then would the target device be selected for the next phase to realign the password. In all other cases (password was aligned already, workflow failed) the target is marked as failed and it would not be considered for realignment of the password.

edit-config private
configure system security user-params local-user user nsptest password t0ps3creT.
commit

1.3.3 Password Update Workflow#

Now that we know when users are in violation of our organization's password policy, we need to automate remedying that situation.

Having familiarity with the mechanics and structure of workflows, it is your turn to create the second workflow. While the first workflow identifies password rule violations, the second workflow can update configured NE user passwords with a password that is specified as input.

Create a workflow called force-update-pass-<<GroupId>>. You may user either NSP WebUI or Visual Studio Code (or code-server) with the NOKIA WFM extension to create and run the workflow. Test your workflow properly before you continue!

version: '2.0'

force-update-pass-<<GroupId>>:
  tags:
    - LSO

  input:
    - neId
    - username
    - password

  output:
    lsoInfo: <% $.lsoInfo %>
    misaligned: <% $.misaligned %>

  output-on-error:
    lsoInfo: <% $.lsoInfo %>
    misaligned: <% $.misaligned %>

  vars:
    lsoInfo: Failed
    lsoStageError: Unknown
    misaligned: "yes"

  tasks:
    checkUsernameIsAdmin:
      action: std.noop
      on-success:
        - avoidAdmin: <% $.username = "admin" %>
        - updateAdminPass: <% $.username != "admin" %>

    avoidAdmin:
      action: std.fail
      publish-on-error:
        lsoInfo: "Info: Admin user cannot be used as input"
        lsoStageError: Admin user cannot be used as input

    updateAdminPass: ## update the NE User password using MDC API
      action: nsp.https
      input:
        method: PATCH
        url: https://restconf-gateway/restconf/data/network-device-mgr:network-devices/network-device=<% $.neId %>/root/
        accept: application/yang-data+json
        contentType: application/yang-patch+json
        body:
          ietf-yang-patch:yang-patch:
            patch-id: patch-pass
            edit:
              - operation: merge
                target: nokia-conf:/configure/system/security/user-params/local-user/user=<% $.username %>
                edit-id: edit-pass
                value:
                  nokia-conf:user:
                    user-name: <% $.username %>
                    password: <% $.password %>
      publish:
        misaligned: "no"
        lsoInfo: <% task().result.content %>
      publish-on-error:
        lsoInfo: "Error: Failed to update <% $.username %> user password"
        lsoStageError: <% task().result %>

Now that we have automated auditing and updating NE password configuration individually, let's see how to combine that into a single operation.

1.3.4 Operation Type#

The first part of creating an operation in the LSOM framework is defining the operation type.

{
  "operation-type": {
    "name": "misaligned-pass-<< GroupId >>",
    "description": "Operation for Misaligned Pass << GroupId >>",
    "category": "other",
    "created-by": "nsp_internal_system_user",
    "operation-model": "misaligned-pass-<< GroupId >>.yang",
    "profile": "misaligned-pass-<< GroupId >>.yaml",
    "life-cycle-state": "released",
    "additional-tag": ["LSO", "SR OS"],
    "version": "1.0.0"
  }
}

1.3.5 Operation Input-Output#

Regardless of whether the operation is single-phase or multi-phase, all phases share the same input and output parameters. If you believe a particular phase does not require certain inputs, default values can also be defined within the phase definition. We will cover this in the next section.

module misaligned-pass-<< GroupId >> {
  yang-version 1.1;
  namespace "urn:nokia:nsp:model:lso:operation:misaligned-pass-<< GroupId >>";
  prefix misaligned-pass-<< GroupId >>;

  import nsp-lso-operation {
    prefix nlo;
  }

  organization "Nokia";
  contact "";
  description "Operation for Misaligned Pass";

  revision 2024-10-08 {
    description "version 1";
    reference "";
  }

  augment "/nlo:lso-operations/nlo:operation" {
    when "operation-type='misaligned-pass-<< GroupId >>'";
    description "Augmentation of operation input";
    container misaligned-pass-<< GroupId >>-operation {
      leaf username {
        type string;
        mandatory true;
        description "Admin username of the node";
      }
      leaf password {
        type string;
        mandatory true;
        description "Intended password on the node";
      }
    }
  }

  augment "/nlo:lso-operations/nlo:operation/nlo:executions/nlo:execution" {
    when "../../operation-type='misaligned-pass-<< GroupId >>'";
    description "Augmentation of operation execution state data";
    container misaligned-pass-<< GroupId >>-execution {
      leaf misaligned {
        type string;
        description "Indicates misalignment of password";
      }
    }
  }
}

With the operation's input and output defined let's see how we specify the operation's phases.

1.3.6 Operation Phases#

This section defines the phases used in the Operation Type execution. It includes the phase name, description, concurrency limits, supported NE families and versions as well as the workflow triggered during each phase.

phases:
  - phase: Audit
    description: Audit for misaligned Admin user password
    concurrency_count: 20
    phase_timeout: 15
    ne_families:
      - family_type: 7750 SR, 7950 XRS, 7450 ESS, 7250 IXR
        ne_versions:
          - version: all
            workflow_name: audit-misaligned-pass-<< GroupId >>
            workflow_inputs:

Now that we're familiar with writing the Audit phase, it is left up to you as an exercise to construct the Update phase. This phase is like the Audit phase shown above.

  - phase: Update
    description: Force update Admin user password
    concurrency_count: 20
    phase_timeout: 15
    ne_families:
      - family_type: 7750 SR, 7950 XRS, 7450 ESS, 7250 IXR
        ne_versions:
          - version: all
            workflow_name: force-update-pass-<< GroupId >>
            workflow_inputs:

Now that we've created all the files related to the LSO operation, let's consolidate this information into an operation metadata file. This file enables NSP to verify the integrity of the operation package and determine the target application onto which the files should be deployed.

1.3.7 Operation Metadata#

This section defines the metadata and artifact details required for the Device Operation. It describes the versioning scheme, creation details, and the list of files included in the artifact, along with their format and purpose.

{
  "meta-data-header": {
    "version": "1.0.0",
    "buildNumber": "1",
    "formatVersion": "1.0",
    "createdBy": "SRX Hackathon 2025",
    "creationDate": "Tue, 06 May 2024 00:00:00 UTC",
    "title": "Operation for Misaligned Pass << GroupId >>",
    "description": "Operation for Misaligned Pass"
  },
  "artifact-meta-data": [
    {
      "name": "misaligned-pass-<< GroupId >>",
      "version": "1.0.0",
      "targetApplication": "lsom-server-app",
      "applicationCompatibility": "23.3+",
      "artifact-content": [
        {
          "fileName": "misaligned-pass-<< GroupId >>.yaml",
          "path": "operation-types",
          "type": "application/octet-stream"
        },
        {
          "fileName": "misaligned-pass-<< GroupId >>.yang",
          "path": "operation-types",
          "type": "application/octet-stream"
        },
        {
          "fileName": "operation_types.json",
          "path": "operation-types",
          "type": "application/octet-stream"
        }
      ]
    },
    {
      "name": "audit-misaligned-pass-<< GroupId >>",
      "version": "1.0.0",
      "targetApplication": "workflow-manager",
      "applicationCompatibility": "23.3+",
      "artifact-content": [
        {
          "fileName": "audit-misaligned-pass-<< GroupId >>.yaml",
          "path": "workflows/audit-misaligned-pass",
          "type": "application/octet-stream"
        }
      ]
    },
    {
      "name": "force-update-pass-<< GroupId >>",
      "version": "1.0.0",
      "targetApplication": "workflow-manager",
      "applicationCompatibility": "23.3+",
      "artifact-content": [
        {
          "fileName": "force-update-pass-<< GroupId >>.yaml",
          "path": "workflows/force-update-pass",
          "type": "application/octet-stream"
        }
      ]
    }
  ]
}

1.3.8 Build & Installation#

We now have all the necessary files and directories in place to proceed uploading the LSO operation we have created to NSP.

To do that, perform the following:

1. Let's ZIP the directory content (not the directory itself).
2. Rename the file to misaligned-pass-<< GroupId >>.zip
3. Install the package into NSP using the Artifact Administrator WebUI.

zip -d misaligned-pass-<< GroupId >>.zip __MACOSX/\*
zip -d misaligned-pass-<< GroupId >>.zip \*/.DS_Store

1.3.9 Execution#

1. Create a new user nspuser on both PE1 and PE2 using random passwords.
2. After the artifact installation is complete, open the Device Management application.
3. From the dropdown menu, select All Operations, then create a new operation by clicking the + OPERATION button in the top-right corner.
4. Execute the audit/realign operation on PE1 and PE2.
5. Verify the operation results and confirm the device passwords.
6. Modify the password on PE1 only.
7. Execute the audit/realign operation again.
8. Check the operation results and verify the device passwords once more.

Expected result: Any password misalignment is detected and automatically corrected.

1.4 Summary#

Congratulations — you’ve completed this activity! Take a moment to reflect on what you achieved:

• Built and packaged NSP workflows into an Artifact Bundle
• Combined validation and remediation logic into a single Device Operation
• Enforced password compliance across devices through LSOM-managed execution
• Interacted with devices using YANG-modeled data and RESTCONF APIs