Re: Validating Old Passwords Before Changing Them

On Jan 31, 6:21 pm, "Joe Kaplan"
<joseph.e.kap...@xxxxxxxxxxxxxxxxxxxxxxxx> wrote:
You can't do an LDAP bind when the user's state is set to "user must change
password at next logon". In fact, I don't think you can call LogonUser
either. I'm not actually sure how GINA does this, but there does not seem
to be a straightforward way to take advantage of this OS features.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"http://www.directoryprogramming.net
--"Alan" <balas...@xxxxxxxxx> wrote in message

news:62aa883b-1cd4-4cb0-8c68-7f3cf3dc6d04@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Hi,

I'd like to write a custom logon control, and I've run into a snag
when trying to handle "User Must Change Password At Next Login"

I'd like to validate a users old/current password against the domain
before showing the user the form to change the password.

Doing an LDAP Bind() fails with the current creds.

Any Ideas how to accomplish this?

Thanks,
-Alan

Joe K,

Thanks for the reply.

LogonUser appears to work, in that it still returns non-zero, but
GetLastWin32Error() will return "ERROR_USER_MUST_CHANGE_PASSWORD" if
the password is valid, and the users password must change. I think
this is the only approach.

-Alan
.

Relevant Pages

  • Re: Problem establishing SSL connection in code-behind
    ... On Jan 4, 6:04 pm, "Joe Kaplan" ... The 540 event is the logon ... anything different between what is generated for wfetch vs. .NET. ... Co-author of "The .NET Developer's Guide to Directory Services Programming"http://www.directoryprogramming.net ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Problem establishing SSL connection in code-behind
    ... On Jan 7, 4:48 pm, "Joe Kaplan" ... question must actually be able to perform the requested logon type on the ... Co-author of "The .NET Developer's Guide to Directory Services Programming"http://www.directoryprogramming.net ... Caller User Name: - ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • error from federation server proxy
    ... the application is not opening and going to federation server ... "Joe Kaplan" wrote: ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ...
    (microsoft.public.windows.server.active_directory)
  • Re: LDIFDE Error when trying to change passwords.
    ... "Joe Kaplan" wrote: ... The -h adds the encryption. ... Co-author of "The .NET Developer's Guide to Directory Services ... command or the bind command as I am not sure how to use them. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Integrated Windows Authentication Timeout?
    ... "Joe Kaplan" wrote: ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... long as they are all on the same account. ... SPN exists on the account that is running the service. ...
    (microsoft.public.dotnet.framework.aspnet.security)