Cannot change password in HAP+

[jonwitts]

Hi there when ever a user tries to change their password through HAP+ we are getting the following logged to the web server's event log and the user gets a warning message to their browser:

 

-------------------------------------------

 

An error occurred in Home Access Plus+

 

Page: System.DirectoryServices.AccountManagement

 

The system detected a possible attempt to compromise security. Please ensure that you can contact the server that authenticated you. (Exception from HRESULT: 0x800704F1)

 

 

System.DirectoryServices.AccountManagement.PrincipalOperationException: The system detected a possible attempt to compromise security. Please ensure that you can contact the server that authenticated you. (Exception from HRESULT: 0x800704F1) ---> System.Runtime.InteropServices.COMException: The system detected a possible attempt to compromise security. Please ensure that you can contact the server that authenticated you. (Exception from HRESULT: 0x800704F1)

--- End of inner exception stack trace ---

at System.DirectoryServices.AccountManagement.SDSUtils.ChangePassword(DirectoryEntry de, String oldPassword, String newPassword)

at System.DirectoryServices.AccountManagement.ADStoreCtx.ChangePassword(AuthenticablePrincipal p, String oldPassword, String newPassword)

at HAP.AD.User.ChangePassword(String oldPassword, String newPassword)

at HAP.Web.LiveTiles.API.SetPassword(String oldpassword, String newpassword)

at SyncInvokeSetPassword(Object , Object[] , Object[] )

at System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs)

at System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc& rpc)

at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc)

at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage31(MessageRpc& rpc)

at System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet)

 

 

at System.DirectoryServices.AccountManagement.SDSUtils.ChangePassword(DirectoryEntry de, String oldPassword, String newPassword)

at System.DirectoryServices.AccountManagement.ADStoreCtx.ChangePassword(AuthenticablePrincipal p, String oldPassword, String newPassword)

at HAP.AD.User.ChangePassword(String oldPassword, String newPassword)

at HAP.Web.LiveTiles.API.SetPassword(String oldpassword, String newpassword)

at SyncInvokeSetPassword(Object , Object[] , Object[] )

at System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs)

at System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc& rpc)

at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc)

at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage31(MessageRpc& rpc)

at System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet)

 

-------------------------------------------

 

Any ideas gratefully received!

[jonwitts]

Any thoughts on this issue, anybody?

 

It is beginning to cause us some real operational issues as BYOD users are struggling to get their passwords changed now!

[jonwitts]

OK, so I have found out the reason... two MS updates are at play here: https://support.microsoft.com/en-us/kb/3177108 and https://support.microsoft.com/en-us/kb/3167679

 

Whilst uninstalling these updates would get things going this is not a suitable fix in the long term! The reason that it is failing is because to use the ChangePassword object you now need to pass the UPN of the user and not the samaccountname.

 

Anyway; thought I would post this here. We are now using this tool for BYOD password resets: https://github.com/unosquare/passcore

 

Jon