IIS Windows Authentication - Change Password at next login

Question

I have set windows authentication and forms based authentication (FBA) in IIS for my web application. I added users to windows so they can login using the windows prompt. I set the checkbox to force them to change their password at the next login.

Now my windows users can't log in. I think it has something to do with the change password at next login. How can I setup iis or something to be redirected to change their initial password. I don't want them to have to use the generated passwords given to them for their initial login

Answer 1

For users with the "Change Password on Next Logon" set, you want to redirect their request so they can change their password.

Natively, Windows authentication in IIS doesn't allow for this functionality. Users will continue to be denied until their password is changed. You could modify the returned IIS error page with a link to the change password portal or just let your users know that if they can't login try changing their password.

One alternative is to create a custom IIS module which intercepts the request just before the auth process. More information about taking this approach can be found here however I'm 90% certain it will be too complex of a solution.

The recommended solution would be to use forms authentication. Then customize the logon process to identify this change password scenario and redirect the user to a change password screen. This provides the best user experience but also involves a lot of customization.

Finally, don't use Windows Authentication with Forms Authentication. Just choose one. Note that non-Windows clients won't be able to connect using Windows auth.