Self Service Password Reset

[plexer]

Ok I've made the changes that have been suggested can some try it out for me please?

 

It's available from google code:

 

http://sspr.googlecode.com/files/SSPR%202.2.2.zip

 

Ben

[acraiger]

Well,

 

I got this program to work using LDAP for accessing Active Directory to change the password.

The main reason for me doing this was so the user account I use for these operations did not have to be a Domain Admin. I can now just use a regular Domain User account, and just delegate the needed permissions via the OU that holds the user accounts, that you want to be able to reset with this tool.

 

The persmissions I assigned to the user account for resetting passwords at the OU level:

Change Password

Reset Password

Read/Write Account Restrictions

Read pwdLastSet

Write pwdLastSet

Read lockoutTime

Write lockoutTime

 

 

I'm not sure if you need all these permissions, but these are the permissions that were used by similar commercial products I tested.

 

I made quite a few additions to the resetpass fuction in the reset_pass.asp and adminreset.asp, and have attached the files with the additions I made. I also commented out some of the commands as they did not seem to be working with the LDAP commands.

Below is the Code added at the beginning of the resetpass function. You have to enter your NetBiosName, but maybe this can be added to the config file which holds the other Global variables.

 

' Specify the NetBIOS name of the domain and the NT name of the user, Change NetBiosName to your NetBiosName.

strNTName = "NetBiosName" & "\" & strusername

 

' Use the NameTranslate object to convert the NT user name to the

' Distinguished Name required for the LDAP provider.

Set objTrans = CreateObject("NameTranslate")

 

' Initialize NameTranslate by locating the Global Catalog.

objTrans.Init ADS_NAME_INITTYPE_GC, ""

' Use the Set method to specify the NT format of the object name.

objTrans.Set ADS_NAME_TYPE_NT4, strNTName

 

' Use the Get method to retrieve the RPC 1779 Distinguished Name.

strUserDN = objTrans.Get(ADS_NAME_TYPE_1779)

 

 

'END OF CODE FOR LDAP to replace Getobject("WinNt:

 

Then I commented out: 'Set objUser = GetObject("WinNT://" & FQDN & "/" & strusername & ",user") and replaced with:

Set objUser = GetObject("LDAP://" & strUserDN)

 

The force password reset no longer worked, so I replaced this command with:

objUser.Put "PwdLastSet", 0

 

The code probably needs a little cleaned up, as I did not remove any code, but instead just commented it out.

 

I thinking I'm just ready to roll this out on our production network.

ResetPass.zip

[plexer]

Awesome work when I can get hold of Irazmus I'll point him to this and see what we do with this, this way sounds more secure tbh not sure if it will break anything else.

 

Ben

[burgemaster]

This new release is now tested and working on our IIS server.

 

I have also used a deligated normal account and this also works fine.

 

Only one question, would it be possible that the "Change password when next logon" could be unchecked?

I can see kids getting confused, just a thought

 

Cheers all

Edited April 2, 2009 by burgemaster

[luckyboyhcm]

Thanks all of you. I search for this Self Services Password Reset so long.

I want to ask you something: When i use yourserver/update/index.asp for register user, after that i can't login with another user. It remember the first user. how can i put a logout function after i update information.

Thanks again .

[burgemaster]

We have just gone live with this at our school

 

it is working fine, BUT when a password is reset the account remains LOCKED OUT.

 

Is there any way that you guys could add the code to UNLOCK the account on a password reset?

 

Maybe add a button to unlock on the admin menu?

 

OR, is this supposed to also unlock the account but i have permission problem on the designated account?

 

Thanks in advance

[plexer]

Ok will look into that we didn't encounter that problem because our password policy doesn't lock an account after invalid attempts.

 

Ben

[plexer]

Try this

 

Change line 276

 

From:

 

oUser.Put "PasswordExpired", CLng(1)

 

To:

 

oUser.Put "IsAccountLocked", CLng(0)

 

Ben

[burgemaster]

Thanks for the quick reply,

 

I have changed this in "reset_pass.asp", is that correct ?

Not working unfortunetly

 

Cheers

Tim

Edited September 8, 2009 by burgemaster

[plexer]

Yes that's the correct file.

 

Ben

[burgemaster]

Not working mate, sorry

 

Still shows as

 

"Account Locked : True "

 

After a password reset

[plexer]

Can you try using the credentials of a Domain Admin it could be that your delegate user cannot unlock an account?

 

Ben

[plexer]

If that does work have a look at this article it explains how to delegate that right.

 

Ben

[burgemaster]

Hi Ben,

I have used the domain admin credentials and still no joy

The password gets changed successfully, but not the UNLOCK

 

IIS doesnt need a restart or anything fancy does it?

 

Cheers

Tim

[plexer]

Ok I was just clasping at some coding straws really I'll have to test it.

 

Try changing it to:

 

oUser.Put IsAccountLocked = FALSE

[plexer]

Also try:

 

oUser.put "lockoutTime", 0

 

Ben

[burgemaster]

oUser.put "lockoutTime", 0

oUser.Put IsAccountLocked = FALSE

oUser.Put "IsAccountLocked", CLng(0)

 

All a negative

 

Thanks for trying Ben

Any other ideas?

[plexer]

hehe I'm trying to figure it out now.

 

I presume when you try any of those you also get "Your password does not meet the complexity requirements"?

 

Ben

[burgemaster]

No mate, all still still work fine.

 

Password gets changed.

 

Ive only tested this from using the Admin Console, should i be testing these as a student reseting the password themselves??

 

One other thing, ive noticed if i restrict (deny NTFS access) for students to my xml containing the pass/username, then they get a 500 IIS error and they cannot load any of the ASP pages??

[plexer]

That file is probably included in the other pages so if it can't be read and it would be one of the first things to be read then you'll get that error.

 

Yeah I was testing it as student trying to reset their own password becuase the admin reset page is completely seperate.

 

Ben

[burgemaster]

Ive tested all 3 suggestions as a student, all work and change the password with no errors.

But the account remains locked out, ive upped the lockout to 10 attempts for now.

 

Cheers

Tim

[plexer]

Tim,

 

Ok same result as me then.

 

I've sent a PM to Irazmus who did the up to date coding on this to see if he has any ideas.

 

It may be that it's just not possible to unlock an account via classic asp.

 

Ben

[Irazmus]

You've already tried the only ideas I currently have for unlocking an account from asp. However I find it hard to believe that Microsoft would prevent/omit unlocking accounts via vb so I'm sure there must be a way of doing it. I'll see what I can find over the next few days and hopefully run some tests next week.

[mthomas08]

Maybe im doing something wrong, I have read through the pages and couldnt find it.

 

Got an issue where I register the username and it appears in the database but the username doesnt go with it. So when I go to reset password, it is telling me invalid so I checked the database its all there becides username is blank.

 

I can add it in but with 1600 users I would rather not!

[burgemaster]

Maybe im doing something wrong, I have read through the pages and couldnt find it.

 

Got an issue where I register the username and it appears in the database but the username doesnt go with it. So when I go to reset password, it is telling me invalid so I checked the database its all there becides username is blank.

 

I can add it in but with 1600 users I would rather not!

 

Permissions on the MDB ?