Re: Policy Hints Control

so i enabled password hash synchronization and password writeback and yes,
automagically, I was able to update domain passwords from the web.

Attn Developers: this is a very useful feature addition, Thanks.

On Thu, 14 May 2026 at 14:44, Douglas Bagnall <
[email protected]> wrote:

> On 14/05/2026 10:54, Ray Klassen via samba wrote:
> >  From the 4.24 release notes.
> >
> > <snip>
> >
> > Support for remote password management (Entra ID SSPR, Keycloak)
> > ----------------------------------------------------------------
> >
> > When a system such as Entra ID or Keycloak wants to change a user's
> > password in its own database as well as in AD, it will use a password
> > reset, meaning it does not transmit the old password to the domain
> > controller. Normally a password reset avoids password history and age
> > checks, which would allow a cloud password change to bypass
> > on-premises password policies. To address this, a password reset using
> > the "policy hints" control should respect password policies, as if it
> > were an ordinary password change. Both Entra ID and Keycloak use this,
> > but until now Samba did not understand this control, and would reject
> > these reset requests.
> >
> > Now Samba AD will recognise the policy hints control and enforce local
> > policy. This allows Microsoft Entra self-service password reset (SSPR)
> > to work, and for Keycloak to work with the "password policy hints
> > enabled" option.
> >
> > </snip>
> >
> > Is there any further information about this? Does the version 4.24.x DC
> > handle 'hints' automagically?
>
> Yes.
>
> Let me know if it doesn't seem to work.
>
> Douglas
>
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba