Re: reset AD user password when account is expired

--001a11c313ac38dd9a0508651154
Content-Type: text/plain; charset=UTF-8

One a password has expired, the only way for a user to reset their own
password is C-A-D from a domain workstation. And no vpn.

-- Sent from my Droid. Please excuse any tpyos and autocorrect errors.
On Nov 21, 2014 4:19 PM, "Natxo Asenjo" <[email protected]> wrote:

> hi,
>
> using code like in the FAQ it is really simple to change the password
> of an AD user.
>
> Unfortunately, once the account is already expired I get this error:
>
> 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext
> error, data 773, v1db1
>
> And according to http://www-01.ibm.com/support/docview.wss?uid=swg21290631
> ,
>
> 80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext
> error, data 773, v893
> HEX: 0x773 - user must reset password
> DEC: 1907 - ERROR_PASSWORD_MUST_CHANGE (The user's password must be
> changed before logging on the first time.)
> LDAP[pwdLastSet: <value of 0 indicates admin-required password
> change>] - MUST_CHANGE_PASSWD
> NOTE: Returns only when presented with valid username and
> password/credential
>
> I am actually binding as the user self (this will be a self-service
> site for our users to reset their passwords). Is it possible to change
> one's password once the account has expired or do I have to bind as a
> service account and reset the user password like that? I prefer not
> having to hardcode credentials in the application, but if there is no
> other way ..
>
> Thanks!
>
> --
> Groeten,
> natxo
>

--001a11c313ac38dd9a0508651154
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<p dir=3D"ltr">One a password has expired, the only way for a user to reset=
 their own password is C-A-D from a domain workstation. And no vpn.</p>
<p dir=3D"ltr">-- Sent from my Droid. Please excuse any tpyos and autocorre=
ct errors.</p>
<div class=3D"gmail_quote">On Nov 21, 2014 4:19 PM, &quot;Natxo Asenjo&quot=
; &lt;<a href=3D"mailto:[email protected]">[email protected]</a>&=
gt; wrote:<br type=3D"attribution"><blockquote class=3D"gmail_quote" style=
=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">hi,<br>
<br>
using code like in the FAQ it is really simple to change the password<br>
of an AD user.<br>
<br>
Unfortunately, once the account is already expired I get this error:<br>
<br>
80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext<br>
error, data 773, v1db1<br>
<br>
And according to <a href=3D"http://www-01.ibm.com/support/docview.wss?uid=
=3Dswg21290631" target=3D"_blank">http://www-01.ibm.com/support/docview.wss=
?uid=3Dswg21290631</a>,<br>
<br>
80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext<br>
error, data 773, v893<br>
HEX: 0x773 - user must reset password<br>
DEC: 1907 - ERROR_PASSWORD_MUST_CHANGE (The user&#39;s password must be<br>
changed before logging on the first time.)<br>
LDAP[pwdLastSet: &lt;value of 0 indicates admin-required password<br>
change&gt;] - MUST_CHANGE_PASSWD<br>
NOTE: Returns only when presented with valid username and password/credenti=
al<br>
<br>
I am actually binding as the user self (this will be a self-service<br>
site for our users to reset their passwords). Is it possible to change<br>
one&#39;s password once the account has expired or do I have to bind as a<b=
r>
service account and reset the user password like that? I prefer not<br>
having to hardcode credentials in the application, but if there is no<br>
other way ..<br>
<br>
Thanks!<br>
<br>
--<br>
Groeten,<br>
natxo<br>
</blockquote></div>

--001a11c313ac38dd9a0508651154--