|
Posted by Joe Kaplan on December 11, 2007, 12:16 pm
Please log in for more thread options You can use LDAP to change passwords. The code would depend on the
programming language you want to write this in. There are many options.
Note that you still can't use this to get around the issue with expired
passwords unless the user can authenticate with an expired password.
LDAP password changes require encryption, so be aware of that. It is
possible to use either Windows built in encryption with SPNEGO auth (on 2003
or higher DCs and XP or higher clients) or use SSL. However, ADSI will only
use SSL, so if you want to use an ADSI-based solution, you'll need SSL on
your DCs.
If you are a .NET programmer, we cover this in gory detail in ch 10 of our
book (see link in my signature).
Joe K.
--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
> Nobody ? :)
>
> Third question so ! :D
>
> 3. Another solution could be to change the password through LDAP v3
> request no ? (from the Web server to a specific DC)
> If you confirm that it is possible, do you have a sample code for this
> kinf of solution please ?
>
> Thank you
>
>
>> Hi Svyatoslav ,
>>
>> thank you for your answer
>>
>> 1. About this, could you tell me which policy allow logging on with
>> expired passwords please ?
>> 2. I will try if nobody can't give me the information before :D
>>
>> Someone has feedbacks about the IIS reset passwords solution ?
>>
>> Thank you
>>
>>> 1. You can set policy to allow logging on with expired passwords to
>>> change the password; otherwise indeed you need anonymous access.
>>> 2. Interesting question. I'm sure kpassword is not used, which leaves us
>>> with RPC - maybe encrypted in SMB. Capture traffic when changing
>>> password on your worksation to fing out - IIS will be same. And as
>>> secure.
>>>
>>> --
>>> Svyatoslav Pidgorny, MS MVP - Security, MCSE
>>> -= F1 is the key =-
>>>
>>> * http://sl.mvps.org * http://msmvps.com/blogs/sp *
>>>
>>>> Hi,
>>>>
>>>> we would like to be able to let users modifying their password through
>>>> IIS (for example).
>>>>
>>>> Indeed, those users are connecting to a IIS server (in US) from another
>>>> country (Italy) but with credentials stored on a local DC (DC in US
>>>> so).
>>>>
>>>> Every user has an account on the DC in US but the security policy
>>>> states that the password has a maximum lifetime of 90 days.
>>>>
>>>> The idea is to let them reseting their password through IIS (and
>>>> IISADMPWD so).
>>>>
>>>> I have two questions :
>>>>
>>>> 1. What's happened if they didn't change their passwords before it
>>>> expired ? (Do I need to let the IISADMPWD with anonymous access so ?)
>>>> 2. What protocol is used when the password is modified from the IIS to
>>>> the DC ? (of course I will use HTTPS from the client to the IIS).
>>>>
>>>> Thank you
>>>>
>>>> -- Pascal
>>>>
>>>>
>
> --
> Pascal
>
>
| 
XML Sitemap