I am doing the c# code to change a ldap user's password by either user himself, or the admin.
I can successfully authenticate the users. However, I get the following error message when I try to invoke a ChangePassword
or SetPassword
behavior:
InnerException: The directory property cannot be found in the cache.
My code is as follows:
LDAPPath = "LDAP://10.29.0.1:50405/DC=DCServerName,DC=local"
LDAPAdminDN = "CN=useradmin,OU=SystemAccounts,DC=DCServerName,DC=local"
LDAPAdminPwd = "S8kf5t3!"
username = "user1"
password = "oldPassword1"
npassword = "newPassword1"
DirectoryEntry root = new DirectoryEntry(
LDAPPath,
LDAPAdminDN,
LDAPAdminPwd,
AuthenticationTypes.None
);
using (root)
{
DirectorySearcher searcher = new DirectorySearcher(root,
string.Format("(CN={0})", username)
);
var result = searcher.FindOne();
if (result != null)
{
var user = result.GetDirectoryEntry();
try
{
user.Invoke("ChangePassword", new object[] { password, npassword });
user.Properties["LockOutTime"].Value = 0;
//user.Invoke("SetPassword", new object[] { npassword });
user.CommitChanges();
}
catch (Exception e)
{
string innerMsg = e.InnerException.Message;
return false;
}
}
I am wondering how to resolve this problem to change the password successfully. Thank you guys
Update: I tried several options as below but all of them don't work: One:
int intPort = 50405;
user.Invoke("SetOption", new object[] { ADS_OPTION_PASSWORD_PORTNUMBER, intPort });
user.Invoke("SetOption", new object[] { ADS_OPTION_PASSWORD_METHOD, ADS_PASSWORD_ENCODE_CLEAR });
Two:
user.UsePropertyCache = true;
They all get error of 0x80072020
My IT guy enabled "change password on nonSSL", I am not sure any settings matter in AD LDS part.
Question: Am I right to use an admin account to change a user's password in this way instead of using any impersonate code?
If you're on .NET 3.5 and up, you should check out the System.DirectoryServices.AccountManagement
(S.DS.AM) namespace. Read all about it here:
Basically, you can define a domain context and easily find users and/or groups in AD:
// set up domain context
using (PrincipalContext ctx = new PrincipalContext(ContextType.Domain))
{
// find a user
UserPrincipal user = UserPrincipal.FindByIdentity(ctx, "SomeUserName");
if(user != null)
{
user.ChangePassword(oldPassword, newPassword);
user.UnlockAccount();
}
}
The new S.DS.AM makes it really easy to play around with users and groups in AD!
Are you using Active Directory?
LDAP://10.29.0.1:50405/DC=DCServerName,DC=local
The URL does not look right.
user.UsePropertyCache = true; Then: user.Invoke("ChangePassword", new object[] { password, npassword });
-jim
User contributions licensed under CC BY-SA 3.0