Using LDAP to authenticate users is common, fast, and easy way to do. A while back I wrote a
tutorial about how this can be done in a web app using the
IP*Works! LDAP component. This particular article was written using VB.Net code samples. Some people ask me for classic ASP code samples,
here you go.
Lots of people ask about how to change an Active Directory (orADAM) user password over LDAP. With Novell, SunOne, and OpenLdap, its not so difficult as long as you have the administrator permissions necessary to make the change. With Active Directory it is a mystery that many have struggled with. I think just about every day in the newsgroups somebody asks how to do this.
There are two common ways to change a user password - through the userPassword and unicodePwd attributes. Here's the basic breakdown:
- userPassword
- If you're not using AD, this is all there is to it. "userPassword" will be a write-only attribute that when set, will change the password for the user. If you are using AD, read on...
- If "userPassword" is a regular password, you can read it and write it but not bind with it.
- If "userPassword" is instead defined as an alias for "unicodePwd", then you can write to "userPassword" directly and bind with that value (in this case "userPassword" will be write-only).
- Whether “userPassword“ is a regular password or an alias for “unicodePwd“ is controlled by the 9th bit of dsHeuristics.
- In ADAM, "userPassword" is defined as an alias for unicodePwd by default.
- You must use an SSL connection in order for this to work with AD!
- unicodePwd
- In AD, by default "userPassword" is a regular attribute and you'll have to use "unicodePwd" instead.
- If you use "unicodePwd", you must set it as a quoted unicode byte array.
- You must use an SSL connection in order for this to work with AD (although from what I understand you may be able to turn that off with dsHeuristics as well. Does anyone have more info on that?)
Note that in both situations above, an SSL connection is required in order to remotely change the password with AD.
If you're bound as an administrative user, you can simply do this password change in one replace command. If you're bound as the end user, you'll have to delete the attribute (using the current password) and then add it back (using the new one).
Update: Added link to
classic asp instructions.