Java与LDAP：在没有管理权限的情况下更改用户密码吗？

Question

Inside a Java Web Project, I'm trying to let users change their own LDAP password (wether it is because it expired or because they simply want to). These users do NOT have administrative rights.

I've been able to do a search to find one of the users, but I'm not able to change it's password. Is there any way to let users change their own LDAP password without giving them Administrative rights?

Here is the code I have right now:

        DirContext context;
        context = getInitialContext(username, password, ldapPath, ldapDomain);

        // Set up search constraints
        SearchControls cons = new SearchControls();
        String[] attrIDs = { "cn" };
        cons.setReturningAttributes(attrIDs);
        cons.setSearchScope(SearchControls.ONELEVEL_SCOPE);

        String USERS_OU = ldapPath.split("/")[ldapPath.split("/").length-1];
        NamingEnumeration<?> results = context.search(USERS_OU, "sAMAccountName=[name]", cons); //I'm searching the sAMA for testing purposes

        while (results.hasMore()) {
            SearchResult result = (SearchResult) results.next();
            Attributes attrs = result.getAttributes();
            String userCN = attrs.get("cn").get(0).toString();

            // Here I'm able to retrieve a user's CN

            ModificationItem[] mods = new ModificationItem[2];
            Attribute mod0 = new BasicAttribute("userPassword", password);
            Attribute mod1 = new BasicAttribute("userPassword", newPass);
            mods[0] = new ModificationItem(DirContext.REMOVE_ATTRIBUTE, mod0);
            mods[1] = new ModificationItem(DirContext.ADD_ATTRIBUTE, mod1);

            context.modifyAttributes([CN + ldapPath], mods );
        }

Thanks in advance!

UPDATE: I've checked the question rkosegi marked, but I think the solution doesn't apply here, since the OP was trying to change to 'unicodePwd', not 'userPassword', and 'unicodePwd' requires the connection to be ldaps.

There's one thing I found out on my research, and it's that on .NET there's a special operation, the DirectoryEntry.Invoke method, being one of it's possible operations 'ChangePassword', which doesn't require admin permissions. Maybe there's something like that on Java?

Answer 1

After an exhausting research, I've come to the conclusion that, based on the default configuration of LDAP servers, codebrane's answer is the right one.

I found out that there's a directive that prevents users from changing their own password, even if it expired. ( This document explains how to determine if it is enabled)

So the solution would be, either changing the directive to allow users to change their own password, or use privileged credentials to do such change.

Thanks!

Answer 2

You normally bind as a privileged user and use that user to change the password for the other user. You can find the users without special permissions, most probably because it allows anonymous binding and searching. Changing a user's password needs to be done using a privileged account.