How to change the Domain Password for a user in LOCK scenario CPUS_UNLOCK_WORKSTATION condition in Custom Credential Provider in Windows 10

Question

I am writing a C++ Custom Credential Provider for Windows 10 system. I have successfully changed the domain user password in CPUS_LOGON scenario , When password expires in

ntsStatus == STATUS_PASSWORD_MUST_CHANGE

situation occurs in

Credential :: ReportResult()

But in LOCK scenario, ie, CPUS_UNLOCK_WORKSTATION , I am not able to Load "PasswordchangeUI" edit fields of

OldPassword, NewPassword, and ConfirmPassword

on the Tile of Credential provider.

I'm using the following code to load these components.

HRESULT hr; ICredentialProviderCredentialEvents*
_pCredProvCredentialEvents;

  hr =
_pCredProvCredentialEvents->SetFieldState((ICredentialProviderCredential*)this, SFI_LOGIN_NAME, CPFS_HIDDEN);  // successfully hides the field.
    hr = _pCredProvCredentialEvents->SetFieldState((ICredentialProviderCredential*)this, SFI_PASSWORD, CPFS_HIDDEN);    // successfully hides the field.

   hr =
_pCredProvCredentialEvents->SetFieldState((ICredentialProviderCredential*)this, SFI_OLDPASSWORD, CPFS_DISPLAY_IN_SELECTED_TILE);  // Fails to load the field.

   hr =
_pCredProvCredentialEvents->SetFieldState((ICredentialProviderCredential*)this, SFI_NEWPASSWORD, CPFS_DISPLAY_IN_SELECTED_TILE);  // Fails to load the field.

   hr =
_pCredProvCredentialEvents->SetFieldState((ICredentialProviderCredential*)this, SFI_CONFPASSWORD, CPFS_DISPLAY_IN_SELECTED_TILE); // Fails to load the field.

Where as in the above code I am successfully hide the SFI_LOGIN_NAME and SFI_PASSWORD fields, But I am not able to display the SFI_OLDPASSWORD, SFI_NEWPASSWORD and SFI_CONFPASSWORD.

I would be thankful to you, if any one could help in this issue.

Regards Aslam

Answer 1

Try this sequence:

1. First try to add new fields.
2. Retarget submit button to one of new fields.
3. Hide old fields.
4. Return CPGSR_NO_CREDENTIAL_NOT_FINISHED status to reactivate user input fields.

Alternative - try to use SFI_PASSWORD instead of SFI_OLDPASSWORD .