DirectoryEntry can not ChangePassword due to Domain Controller. Help?

0

This is suppose to be a basic password change method using DirectoryServices in ASP.NET.

The code:

String path = ConfigurationManager.AppSettings["LDAPServer"] + myDN;
DirectoryEntry de = new DirectoryEntry(path, @"Domain A\" + myUserId, myPassword, AuthenticationTypes.Secure);
de.Invoke("ChangePassword", new object[] { myPassword, myNewPassword});

This runs fine if I run locally via virtual IIS (using Visual Studio). However, if I publish this to production, I get:

Configuration information could not be read from the domain controller, either because the machine is unavailable, or access has been denied. (Exception from HRESULT: 0x80070547)

The only difference between that might be that my computer is on Domain A but the published server is on Domain B. Domain A and Domain B are trusted and Domain A is parent of Domain B.

Anyone have any idea where and how the error is produced?

EDIT: Perhaps I should add that this is a Web Service. Another app will throw necessary information to verify and the Web Service will change the password.

asp.net
web-services
directoryservices
change-password
asked on Stack Overflow Oct 27, 2011 by James • edited Oct 27, 2011 by James

2 Answers

0

Well, what I did to get around issues like the above decribed was the following:

  1. Set up a service account which can query both AD's

First method

private bool ResetDomainAccountPassword(string loginName, string oldPassword, string newPassword)
{
  DirectoryEntry e2 = new DirectoryEntry();

  try
  {
    // ----- Get the credentials for the active directory service account.
    string userName = ServiceUser();
    string password = ServicePassword();

    using (DirectoryEntry e = new DirectoryEntry(Path(), userName, password, AuthenticationTypes.Secure))
    {
      string search = string.Format("(sAMAccountName={0})", loginName);

      DirectorySearcher s = new DirectorySearcher(e, search);

      SearchResult sr = s.FindOne();
      if (sr != null)
      {
        e2 = sr.GetDirectoryEntry();
        e2.Username = userName;
        e2.Password = password;
      }

      if (e2.NativeGuid != null)
      {
        return ResetPassword(e2, oldPassword, newPassword);
      }
      else
        return false;
    }
  }
  catch (Exception ex)
  {
    Exception inner = ex.InnerException;

    // ----- Handle exception here.

    return false;
  }
  finally
  {
    e2.Dispose();
  }
}

The reset password method

private bool ResetPassword(DirectoryEntry e, string oldPassword, string newPassword)
{
  try
  {
    ActiveDs.IADsUser u = e.NativeObject as ActiveDs.IADsUser;
    Type t = e.NativeObject.GetType();
    if (u.IsAccountLocked)
    {
      u.IsAccountLocked = false;
      u.SetInfo();
    }

    u.SetPassword(newPassword);
    u.SetInfo();

    e.CommitChanges();


    return true;
  }
  catch (Exception ex)
  {
    Exception inner = ex.InnerException;

    // ----- Handle exception here.

    return false;
  }
}

One thing I forgot: You need to add a reference to "Active DS Type Library" (COM).

answered on Stack Overflow Oct 27, 2011 by Dimi Takis
0

Sorry to mark yours as answer and take it away. I was actually getting another error because of identity thing and I thought this issue was solved and moved unto next issue.

Anyway, I have solved it by changing the PATH of DirectoryEntry. Before it was:

LDAP://server.domain/DistinguishedName

but I changed it to

LDAP://DistinguishedName

then it was all working fine.

answered on Stack Overflow Nov 1, 2011 by James

User contributions licensed under CC BY-SA 3.0