LDAP Authentication and Password Management

August 19, 2005 · 2 min read

Using LDAP to authenticate users is common, fast, and easy way to do. A while back I wrote a using the IP*Works! LDAP component. This particular article was written using VB.Net code samples. Some people ask me for classic ASP code samples, here you go.

Lots of people ask about how to change an Active Directory (orADAM) user password over LDAP. With Novell, SunOne, and OpenLdap, its not so difficult as long as you have the administrator permissions necessary to make the change. With Active Directory it is a mystery that many have struggled with. I think just about every day in the newsgroups somebody asks how to do this.

There are two common ways to change a user password - through the userPassword and unicodePwd attributes. Here's the basic breakdown:

  1. userPassword
  • If you're not using AD, this is all there is to it. "userPassword" will be a write-only attribute that when set, will change the password for the user. If you are using AD, read on...
  • If "userPassword" is a regular password, you can read it and write it but not bind with it.
  • If "userPassword" is instead defined as an alias for "unicodePwd", then you can write to "userPassword" directly and bind with that value (in this case "userPassword" will be write-only).
  • Whether “userPassword“ is a regular password or an alias for “unicodePwd“ is controlled by the 9th bit of dsHeuristics.
  • In ADAM, "userPassword" is defined as an alias for unicodePwd by default.
  • You must use an SSL connection in order for this to work with AD!
  1. unicodePwd
  • In AD, by default "userPassword" is a regular attribute and you'll have to use "unicodePwd" instead.
  • If you use "unicodePwd", you must set it as a quoted unicode byte array.
  • You must use an SSL connection in order for this to work with AD (although from what I understand you may be able to turn that off with dsHeuristics as well. Does anyone have more info on that?)

Note that in both situations above, an SSL connection is required in order to remotely change the password with AD.

If you're bound as an administrative user, you can simply do this password change in one replace command. If you're bound as the end user, you'll have to delete the attribute (using the current password) and then add it back (using the new one).

Update: Added link to classic asp instructions.

This article is part of the GWB Archives. Original Author: Lance Robinson

New on Geeks with Blogs

  • We Won The One Award I Actually Care About

    Full Scale made the Inc. 5000 for the fifth year straight, the 12th listing across my three companies. Here is why the one award you cannot buy is worth stopping for.

  • Your Customers Build the Features Now

    I let a tool I liked sit dead for a year rather than build the features I wanted. An MCP server meant I never had to, and your customers can do the same to your product.

  • Get the Size of a Directory in Linux the Easy Way

    du -sh for the quick answer, ncdu for the cleanup, df for the disk itself: every command for checking directory size in Linux, plus why du and df never agree.

  • Vim Search and Replace: The Ultimate Guide

    One :%s command replaces every match in a file before a find dialog would even open. The Vim substitute patterns worth the muscle memory: flags, ranges, capture groups, and multi-file edits.