Support LDAP Password Changing
It would be swell if Redmine supported changing LDAP/AD passwords from the UI, especially in the case of passwords that have expired where the user has no way to change it otherwise. I've done some preliminary modifications of account_controller.rb and user.rb to detect when a user's password must be changed, which I can attach as a patch if it's helpful.
#5 Updated by Chris Bush almost 8 years ago
Unfortunately my fix worked for detecting an expired password, but I couldn't get the actual change working in a secure manner. The issue lies in the fact that the LDAP implementation won't allow a bind for an expired account, and so you can't bind the user to change their password. The authentication flag that gets returned for an expired password appears to be the same as what you get for an authentication failure, which means you can't authenticate the user to change their password. It would be a security issue to just blindly change the password using the LDAP admin username/password. I can still attach the patch file if you want, but I think the issue lies in net-ldap.
#6 Updated by Olivier Houdas over 7 years ago
One of our users came across this issue (could not login to Redmine, because his password had expired after his morning login to the network), so I looked at this issue.
It would still be interesting to inform the user properly that his/her password has expired. He can then simply change it on his computer.
However, LDAP programmers advise to use the pwdLastReset and pwdMaxAge attributes (domain level) to calculate whether a password has expired or not.
Unfortunately, it seems that there is no official naming rule, and that it would be pwdMaxAge with Oracle products, and maxPwdAge with Microsoft's Active directory.
Would your patch work for all LDAP providers? Maybe it would still be interesting to use it if so.