Feature #18934
closed
Support LDAP Password Changing
0%
Description
It would be swell if Redmine supported changing LDAP/AD passwords from the UI, especially in the case of passwords that have expired where the user has no way to change it otherwise. I've done some preliminary modifications of account_controller.rb and user.rb to detect when a user's password must be changed, which I can attach as a patch if it's helpful.
Related issues
Updated by Toshi MARUYAMA almost 10 years ago
- Category changed from Accounts / authentication to LDAP
Updated by Jean-Philippe Lang over 9 years ago
- Has duplicate Defect #19165: LDAP managment with REDMINE - Password expired added
Updated by Sébastien ZAJAC over 9 years ago
Hello
Could you attach the patched file?
Updated by Chris Bush over 9 years ago
Unfortunately my fix worked for detecting an expired password, but I couldn't get the actual change working in a secure manner. The issue lies in the fact that the LDAP implementation won't allow a bind for an expired account, and so you can't bind the user to change their password. The authentication flag that gets returned for an expired password appears to be the same as what you get for an authentication failure, which means you can't authenticate the user to change their password. It would be a security issue to just blindly change the password using the LDAP admin username/password. I can still attach the patch file if you want, but I think the issue lies in net-ldap.
Updated by Olivier Houdas over 9 years ago
One of our users came across this issue (could not login to Redmine, because his password had expired after his morning login to the network), so I looked at this issue.
It would still be interesting to inform the user properly that his/her password has expired. He can then simply change it on his computer.
However, LDAP programmers advise to use the pwdLastReset and pwdMaxAge attributes (domain level) to calculate whether a password has expired or not.
Unfortunately, it seems that there is no official naming rule, and that it would be pwdMaxAge with Oracle products, and maxPwdAge with Microsoft's Active directory.
Would your patch work for all LDAP providers? Maybe it would still be interesting to use it if so.
Updated by
Updated by Toshi MARUYAMA almost 9 years ago
- Status changed from New to Closed
- Resolution set to Duplicate
Updated by Toshi MARUYAMA almost 9 years ago
- Is duplicate of Patch #5690: Change LDAP password added