Mailing-List: contact users-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@directory.apache.org
Received-SPF: pass (nike.apache.org: local policy)
From: <Carlo.Accorsi@ibs-ag.com>
To: <users@directory.apache.org>
Subject: RE: pwdMustChange not working
Thread-Topic: pwdMustChange not working
Thread-Index: AQHQV2tfvMhYvPDpdU6BX6jMxDV7AJ0ONXrAgACk+YCAAJgoEA==
Date: Fri, 6 Mar 2015 13:29:51 +0000
Message-ID: <d4b34d7c764846708013d0b02a95d3e9@IBSMSX2.ibs-ag.com>
References: 
 <BLU182-W93F931F84F2E49B5691099C41F0@phx.gbl>,<d5b9f7bdd8714360806d570b3d198da5@IBSMSX2.ibs-ag.com>
 <BLU182-W36C33CD3DF166BCC4B4CAC41C0@phx.gbl>
In-Reply-To: <BLU182-W36C33CD3DF166BCC4B4CAC41C0@phx.gbl>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

Brock,=20
Not sure about that. The only thing I can think of is you may have the ads-=
pwdsafemodify set TRUE.=20
We looked at this feature a couple years ago and I don't think it was imple=
mented then but it may be now in M19.=20
If that's the case, you could try setting it FALSE (and restarting).=20
The studio's UI might not have the ability to provide the existing password=
 while changing. I don't know.
If you post the full stack trace of the exception it may offer better clues=
.  Thanks


-----Original Message-----
From: brock samson [mailto:brock.samson_@hotmail.com]=20
Sent: Friday, March 06, 2015 12:19 AM
To: users@directory.apache.org
Subject: RE: pwdMustChange not working

Carlo,

thank you for such detailed description.
i never mentioned in my initial post that i already had pwdPolicySubentry p=
laced as a user's attribute, though its value is pointing to ads-pwdId=3Dde=
fault,ou=3DpasswordPolicies,ads-interceptorId=3DauthenticationInterceptor,o=
u=3Dinterceptors,adsdirectoryServiceId=3Ddefault,ou=3Dconfig, which is the =
ootb password policy. the part that i did not perform was having the admin =
change that user's password which results in pwdReset attribute being set. =
yet when i signed in as an admin (uid=3Dadmin,ou=3Dsystem) to apache studio=
 and then proceeded to change a user's (uid=3Dbob,ou=3Dusers,o=3Dmycompany)=
 passwod, i got the following error: LdapNoPermissionException: trying to u=
pdate password attribute without the supplying the old password. do you kno=
w what i am doing wrong? should an admin be forced to enter an old password=
? if that is the case, how do i make apache studio do that? thanks.

> From: Carlo.Accorsi@ibs-ag.com
> To: users@directory.apache.org
> Subject: RE: pwdMustChange not working
> Date: Thu, 5 Mar 2015 19:04:58 +0000
>=20
> Hi, we've been that feature for quite some time to force a user to change=
 their password after it's been reset by an admin.=20
>=20
> Make sure the user(s) you want this to affect have the pwdPolicySubEntry =
attribute set on their entry with the  DN of the password policy entry.
>=20
> For example
>=20
> dn: uid=3Djsmith,ou=3Dusers,ou=3Dint,o=3Dcompany
> uid: jsmith
> cn: jsmith
> ...
> pwdPolicySubEntry: ads-pwdId=3DinternalUsers,ou=3DpasswordPolicies,ads-in=
terceptorId=3DauthenticationInterceptor,ou=3Dinterceptors,adsdirectoryServi=
ceId=3Ddefault,ou=3D
>  config
>=20
> Then on the policy entry itself, the attribute ads-pwdmustchange must be =
set TRUE.=20
> And he policy must be enabled, ads-enabled=3DTRUE
>=20
> If you've made changes to the policy, restart the server.=20
>=20
> Then if an admin, using the bind credentials (uid=3Dadmin,ou=3Dsystem) se=
ts the password for jsmith, the  pwdReset attribute is added to their user =
entry.
> The next time jsmith binds with their credentials, you get a signal that =
the password must change in the bind response.=20
> Here's some pseudo code:
>=20
> 			BindRequest bindRequest =3D new BindRequestImpl();
> 			bindRequest.setDn(dn);
> 			bindRequest.setCredentials(strPassword);
>=20
> 			LdapApiService codec =3D LdapApiServiceFactory.getSingleton();
> 			PasswordPolicyDecorator pwCtrl =3D new PasswordPolicyDecorator(codec,n=
ew PasswordPolicyImpl()); =20
> 		=09
> 			bindRequest.addControl(pwCtrl);
> 			BindResponse bindResponse =3D connection.bind(bindRequest);
> 			PasswordPolicyResponse pw =3D null;
> 			PasswordPolicy pwPolicy =3D ((PasswordPolicyDecorator)ctrl).getDecorat=
ed();
>=20
> 		if (pwPolicy.hasResponse())
> 		{
> 			pw =3D pwPolicy.getResponse();
> 			// process password response. =09
>=20
> 			if (PasswordPolicyErrorEnum.CHANGE_AFTER_RESET =3D=3D ctrl.getPassword=
PolicyError()) =20
> 				{
> 				// this will be true when the pwdRest attr is present on the user.
> 				// call your change password code here
> 				}
>=20
>=20
> 		}
>=20
> After the jsmith user changes their password (with their credentials) the=
 pwdReset attribute is removed from their entry.
>=20
> =09
>  Hope this helps.
>=20
>=20
> -----Original Message-----
> From: brock samson [mailto:brock.samson_@hotmail.com]=20
> Sent: Thursday, March 05, 2015 12:39 PM
> To: users@directory.apache.org
> Subject: pwdMustChange not working
>=20
> i am running apacheds2-M19, and changing pwdMustChange password policy at=
tribute's value from FALSE to TRUE does not have any effect. after server r=
estart and using the typical LdapNetworkConnection.bind() function, and res=
ponse is marked with SUCCESS. also, despite very good description of pretty=
 much every password policy attribute on your doc site, there is absolutely=
 nothing written about this particular attribute.
>  		 	   		 =20
 		 	   		 =20