如何使用JAVA WebApplication更改初始ActiveDirectory密码？

Question

Currently I have developed a Java WebApplication to offer the ability to change AD-controlled passwords. The WebApplication uses LDAP access to do this. The users need to authenticate and then their password is changed bei a "LdapContext.modifyAttributes()"-method.

Now I experienced that this does not work for users with an initial password. Initial password means the flag "pwdLastSet" is set to require password change by next logon.

This is, how it works now.

prop.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory");
prop.put(Context.PROVIDER_URL, "ldaps://my.active.directory.com:636");
prop.put(Context.SECURITY_AUTHENTICATION, "simple");
prop.put(Context.SECURITY_PROTOCOL,"ADSecurityProtocol");
prop.put(Context.SECURITY_PRINCIPAL,this.userid);
prop.put(Context.SECURITY_CREDENTIALS,password);
ldapContext = new InitialLdapContext(prop, null); 

<...snip...>

ModificationItem[] mods = new ModificationItem[2];
String oldQuotedPassword = "\"" + oldPassword + "\"";
byte[] oldUnicodePassword = oldQuotedPassword.getBytes("UTF-16LE");
String newQuotedPassword = "\"" + newPassword1 + "\"";
byte[] newUnicodePassword = newQuotedPassword.getBytes("UTF-16LE");

mods[0] = new ModificationItem(DirContext.REMOVE_ATTRIBUTE,
new BasicAttribute("unicodePwd", oldUnicodePassword));
mods[1] = new ModificationItem(DirContext.ADD_ATTRIBUTE,
new BasicAttribute("unicodePwd", newUnicodePassword));
ldapContext.modifyAttributes(userDN, mods);

I'm looking for an idea how to enable users to change their password especially when they are required to do so. I found some hints that Kerberos might be required - but I almost don't know anything about Kerberos.

Any help is appreciated.

Ulrich

Answer 1

I didn't quite get the question. The code pasted doesn't work when pwdLastSet is set ? or you looking for an idea to let the users know that they have to change their pwd ?

If code isn't working, have you tried DirContext.REPLACE_ATTRIBUTE ?

If you needed a way to let users know, just catch the exception and show a error msg on the ui.

Answer 2

Try to use the Apache LDAP API, it seems easier than pure JNDI.

I did a blog post about it, but using AWS Simple AD implementation. I may be useful: http://blog.techutils.space/2016/02/changing-samba4-aws-simple-ad-user.html