LDAP: Unable to Change Password

0

I am doing the c# code to change a ldap user's password by either user himself, or the admin. I can successfully authenticate the users. However, I get the following error message when I try to invoke a ChangePassword or SetPassword behavior:

InnerException: The directory property cannot be found in the cache.

My code is as follows:

LDAPPath = "LDAP://10.29.0.1:50405/DC=DCServerName,DC=local"
LDAPAdminDN = "CN=useradmin,OU=SystemAccounts,DC=DCServerName,DC=local"
LDAPAdminPwd = "S8kf5t3!"
username = "user1"
password = "oldPassword1"
npassword = "newPassword1"

DirectoryEntry root = new DirectoryEntry(
LDAPPath,
LDAPAdminDN,
LDAPAdminPwd,
AuthenticationTypes.None
);

using (root)
{
    DirectorySearcher searcher = new DirectorySearcher(root,
        string.Format("(CN={0})", username)
        );
    var result = searcher.FindOne();
    if (result != null)
    {
        var user = result.GetDirectoryEntry();
        try
        {
            user.Invoke("ChangePassword", new object[] { password, npassword });
            user.Properties["LockOutTime"].Value = 0; 
            //user.Invoke("SetPassword", new object[] { npassword });
            user.CommitChanges();
        }
        catch (Exception e)
        {
            string innerMsg = e.InnerException.Message;
            return false;
        }
    }

I am wondering how to resolve this problem to change the password successfully. Thank you guys

Update: I tried several options as below but all of them don't work: One:

int intPort = 50405;
user.Invoke("SetOption", new object[] { ADS_OPTION_PASSWORD_PORTNUMBER, intPort });
user.Invoke("SetOption", new object[] { ADS_OPTION_PASSWORD_METHOD, ADS_PASSWORD_ENCODE_CLEAR });

Two:

user.UsePropertyCache = true;

They all get error of 0x80072020

My IT guy enabled "change password on nonSSL", I am not sure any settings matter in AD LDS part.

Question: Am I right to use an admin account to change a user's password in this way instead of using any impersonate code?

c#
active-directory
ldap
directoryentry
asked on Stack Overflow Jul 10, 2013 by HanYi Zhang • edited Jul 12, 2013 by HanYi Zhang

2 Answers

2

If you're on .NET 3.5 and up, you should check out the System.DirectoryServices.AccountManagement (S.DS.AM) namespace. Read all about it here:

Basically, you can define a domain context and easily find users and/or groups in AD:

// set up domain context
using (PrincipalContext ctx = new PrincipalContext(ContextType.Domain))
{
    // find a user
    UserPrincipal user = UserPrincipal.FindByIdentity(ctx, "SomeUserName");

    if(user != null)
    {
        user.ChangePassword(oldPassword, newPassword);
        user.UnlockAccount();
    }
}

The new S.DS.AM makes it really easy to play around with users and groups in AD!

answered on Stack Overflow Jul 10, 2013 by marc_s
0

Are you using Active Directory?

LDAP://10.29.0.1:50405/DC=DCServerName,DC=local

The URL does not look right.

user.UsePropertyCache = true; Then: user.Invoke("ChangePassword", new object[] { password, npassword });

-jim

answered on Stack Overflow Jul 12, 2013 by jwilleke

User contributions licensed under CC BY-SA 3.0