Change/Reset User Password

R

rawCoder

Hi All

using the code on http://support.microsoft.com/default.aspx?scid=kb;en-us;Q269190
I tried to set a user password after creating a user but it returns
error <53> ( on Netscape SDK it is LDAP_UNWILLING_TO_PERFORM ) And
when i try to change the password i get error <19>
LDAP_CONSTRAINT_VIOLATION.

Code is attached along - what mistake am i doing. Using IE i have
checked that the 128 Bit cipher strength is available on both server
and client. What else is needed for the SSL requirement ? I am logged
in as Administrator so thats no problem. Using Win2k Server and
Client.

Any ideas are most welcome.

Salman Ahmad Khan

int resetPassword(const char *pszUserDN, const char *pszPassword )
{
if( m_pLDAP == NULL)
return -1;

LDAPMod modPassword;
LDAPMod *modEntry[2];
berval pwdBerVal;
berval *pwd_attr[2];
char pszPasswordWithQuotes[1024];

// Build an array of LDAPMod.
// For setting unicodePwd, this MUST be a single op.
modEntry[0] = &modPassword;
modEntry[1] = NULL;

// Build mod struct for unicodePwd.
modPassword.mod_op = LDAP_MOD_REPLACE | LDAP_MOD_BVALUES;
modPassword.mod_type = "unicodePwd";
modPassword.mod_vals.modv_bvals = pwd_attr;

// Password will be single valued, so we only have one element.
pwd_attr[0] = &pwdBerVal;
pwd_attr[1]= NULL;

// Surround the password in quotes.
sprintf(pszPasswordWithQuotes,"\"%s\"",pszPassword);

// Build the BER structure with the UNICODE password.
pwdBerVal.bv_len = strlen(pszPasswordWithQuotes) * sizeof(char);
pwdBerVal.bv_val = pszPasswordWithQuotes;

int nResult;
// Call the LDAP modify API
nResult = ldap_modify_s(m_pLDAP, pszUserDN, modEntry );
return nResult;
}

int changePassword(const char *pszUserDN, const char *pszOldPassword ,
const char *pszNewPassword )
{
if( m_pLDAP == NULL)
return -1;

LDAPMod modOldPassword;
LDAPMod modNewPassword;
LDAPMod *modEntry[3];
berval oldPwdBerVal;
berval newPwdBerVal;
berval *oldPwd_attr[2];
berval *newPwd_attr[2];
char pszOldPasswordWithQuotes[1024];
char pszNewPasswordWithQuotes[1024];

// Build an array of LDAPMod.
// For setting unicodePwd, this MUST be a double op.
modEntry[0] = &modOldPassword;
modEntry[1] = &modNewPassword;
modEntry[2] = NULL;

// Build mod struct for unicodePwd Add.
modNewPassword.mod_op = LDAP_MOD_ADD | LDAP_MOD_BVALUES;
modNewPassword.mod_type = "unicodePwd";
modNewPassword.mod_vals.modv_bvals = newPwd_attr;

// Build mod struct for unicodePwd Delete.
modOldPassword.mod_op = LDAP_MOD_DELETE | LDAP_MOD_BVALUES;
modOldPassword.mod_type = "unicodePwd";
modOldPassword.mod_vals.modv_bvals = oldPwd_attr;

// Password will be single valued, so we only have one element.
newPwd_attr[0] = &newPwdBerVal;
newPwd_attr[1]= NULL;
oldPwd_attr[0] = &oldPwdBerVal;
oldPwd_attr[1]= NULL;

// Surround the passwords in quotes.
sprintf(pszNewPasswordWithQuotes,"\"%s\"",pszNewPassword);
sprintf(pszOldPasswordWithQuotes,"\"%s\"",pszOldPassword);

// Build the BER structures with the UNICODE passwords w/quotes.
newPwdBerVal.bv_len = strlen(pszNewPasswordWithQuotes) *
sizeof(char);
newPwdBerVal.bv_val = pszNewPasswordWithQuotes;
oldPwdBerVal.bv_len = strlen(pszOldPasswordWithQuotes) *
sizeof(char);
oldPwdBerVal.bv_val = pszOldPasswordWithQuotes;

int nResult;
// Call the LDAP modify API
nResult = ldap_modify_s(m_pLDAP, pszUserDN, modEntry );
return nResult;
}
 
D

David Fisher [MSFT]

Hello Salman.

In order for domain controllers to perform LDAP password change requests,
you will need to enable SSL on the domain controllers. This is detailed in
the following article:
247078 HOW TO: Enable Secure Socket Layer (SSL) Communication over LDAP for
http://support.microsoft.com/?id=247078

This will enable LDAP over SSL on port 636. This is a requirement when
attempting to perform a password change.

263991 How to Set a User's Password with Ldifde
http://support.microsoft.com/?id=263991

Best Regards,
David Fisher
Enterprise Platform Support


rawCoder said:
Hi All

using the code on http://support.microsoft.com/default.aspx?scid=kb;en-us;Q269190
I tried to set a user password after creating a user but it returns
error <53> ( on Netscape SDK it is LDAP_UNWILLING_TO_PERFORM ) And
when i try to change the password i get error <19>
LDAP_CONSTRAINT_VIOLATION.

Code is attached along - what mistake am i doing. Using IE i have
checked that the 128 Bit cipher strength is available on both server
and client. What else is needed for the SSL requirement ? I am logged
in as Administrator so thats no problem. Using Win2k Server and
Client.

Any ideas are most welcome.

Salman Ahmad Khan

int resetPassword(const char *pszUserDN, const char *pszPassword )
{
if( m_pLDAP == NULL)
return -1;

LDAPMod modPassword;
LDAPMod *modEntry[2];
berval pwdBerVal;
berval *pwd_attr[2];
char pszPasswordWithQuotes[1024];

// Build an array of LDAPMod.
// For setting unicodePwd, this MUST be a single op.
modEntry[0] = &modPassword;
modEntry[1] = NULL;

// Build mod struct for unicodePwd.
modPassword.mod_op = LDAP_MOD_REPLACE | LDAP_MOD_BVALUES;
modPassword.mod_type = "unicodePwd";
modPassword.mod_vals.modv_bvals = pwd_attr;

// Password will be single valued, so we only have one element.
pwd_attr[0] = &pwdBerVal;
pwd_attr[1]= NULL;

// Surround the password in quotes.
sprintf(pszPasswordWithQuotes,"\"%s\"",pszPassword);

// Build the BER structure with the UNICODE password.
pwdBerVal.bv_len = strlen(pszPasswordWithQuotes) * sizeof(char);
pwdBerVal.bv_val = pszPasswordWithQuotes;

int nResult;
// Call the LDAP modify API
nResult = ldap_modify_s(m_pLDAP, pszUserDN, modEntry );
return nResult;
}

int changePassword(const char *pszUserDN, const char *pszOldPassword ,
const char *pszNewPassword )
{
if( m_pLDAP == NULL)
return -1;

LDAPMod modOldPassword;
LDAPMod modNewPassword;
LDAPMod *modEntry[3];
berval oldPwdBerVal;
berval newPwdBerVal;
berval *oldPwd_attr[2];
berval *newPwd_attr[2];
char pszOldPasswordWithQuotes[1024];
char pszNewPasswordWithQuotes[1024];

// Build an array of LDAPMod.
// For setting unicodePwd, this MUST be a double op.
modEntry[0] = &modOldPassword;
modEntry[1] = &modNewPassword;
modEntry[2] = NULL;

// Build mod struct for unicodePwd Add.
modNewPassword.mod_op = LDAP_MOD_ADD | LDAP_MOD_BVALUES;
modNewPassword.mod_type = "unicodePwd";
modNewPassword.mod_vals.modv_bvals = newPwd_attr;

// Build mod struct for unicodePwd Delete.
modOldPassword.mod_op = LDAP_MOD_DELETE | LDAP_MOD_BVALUES;
modOldPassword.mod_type = "unicodePwd";
modOldPassword.mod_vals.modv_bvals = oldPwd_attr;

// Password will be single valued, so we only have one element.
newPwd_attr[0] = &newPwdBerVal;
newPwd_attr[1]= NULL;
oldPwd_attr[0] = &oldPwdBerVal;
oldPwd_attr[1]= NULL;

// Surround the passwords in quotes.
sprintf(pszNewPasswordWithQuotes,"\"%s\"",pszNewPassword);
sprintf(pszOldPasswordWithQuotes,"\"%s\"",pszOldPassword);

// Build the BER structures with the UNICODE passwords w/quotes.
newPwdBerVal.bv_len = strlen(pszNewPasswordWithQuotes) *
sizeof(char);
newPwdBerVal.bv_val = pszNewPasswordWithQuotes;
oldPwdBerVal.bv_len = strlen(pszOldPasswordWithQuotes) *
sizeof(char);
oldPwdBerVal.bv_val = pszOldPasswordWithQuotes;

int nResult;
// Call the LDAP modify API
nResult = ldap_modify_s(m_pLDAP, pszUserDN, modEntry );
return nResult;
}
Click to expand...
 
Top