Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

It seems like every shop that uses LDAP at some point has to cobble together something to let users reset their passwords without bothering the IT staff. The workflow almost always looks like:

  1. User gives username (jblow)
  2. Email jblow@company a link
  3. User clicks link, puts in a new password

On the backend, that corresponds to:

  1. Web form gets a username, stores (username, big unique string) in a DB, emails big unique string to username@company
  2. Other form has a click on https://site/pwreset/big unique string , uses that to authenticate the user, changes their password

Right? So, has someone written one of these that they share? I'd rather use one that's had a bit more thought put into it than the 10 minute job everyone seems to do.

I did a quick search of Sourceforge, Freshmeat etc and didn't find anything that wasn't abandoned.

share|improve this question
4  
Why do your users have LDAP passwords that are different from their email passwords? –  84104 Jul 29 '11 at 23:07
    
Do you want "reset when user has forgotten" or "periodic change"? They're two quite different requirements, and in a corporate environment I don't think I'd really want to let people reset passwords automatically when they forget them. At any rate, most places probably roll their own because integrating all the password-related policies into a standard tool is just too much effort. –  womble Jul 30 '11 at 1:03
    
user84104: Different environments. Email is in the office, LDAP is in our production site. We don't want production things authing to the office, because it would be bad if production went down because the office was being worked on :) –  Bill Weiss Jul 30 '11 at 14:51
    
Womble: Really? Assuming we auth them in some manner (such as access to email, which is a different pw, etc), why not let them reset their passwords? –  Bill Weiss Jul 30 '11 at 14:51
    
@Bill: did you find anything useful? I need to do the same thing. –  Jason S Sep 28 '11 at 22:05
show 4 more comments

closed as off topic by MDMarra, Iain Feb 20 '12 at 15:17

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

7 Answers

We use horde for password changes, but not sure if it can fit the workflow you want.

share|improve this answer
    
I'll take a look. –  Bill Weiss Jul 29 '11 at 20:59
    
It looks like it would be a pretty huge install to just do password changes. Is there a component that does that that I don't see? –  Bill Weiss Jul 29 '11 at 21:43
2  
horde.org/apps/passwd –  churnd Aug 23 '11 at 20:18
    
Oh, ok. How did I miss that? Thanks! –  Bill Weiss Aug 24 '11 at 1:45
    
Did it work out for you? –  churnd Sep 2 '11 at 17:17
add comment

This isn't the best documented project, but it has the advantage of being fairly simple PHP with a couple of installers for various linux flavors that get it up and running fast:

http://ltb-project.org/wiki/documentation/self-service-password/

If you are concerned about security, my recommendation is to use a more fully supported widely used package, since I don't know how well this project has been put through its paces.

share|improve this answer
    
Hey, that looks pretty good! I'll give it a shot. –  Bill Weiss Sep 26 '11 at 22:29
add comment

phpLdapPasswd, but it is no longer being maintained.

share|improve this answer
    
Yeah, I saw that one, but the big "HEY, NO ONE CARES FOR THIS CODE ANYMORE" always worries me. –  Bill Weiss Jul 29 '11 at 20:58
add comment

ADSelfService Plus from ManageEngine is available in a free version. You'll have to check it out for yourself to determine the limitations of the free version to see if it fits your needs.

share|improve this answer
    
I'll take a look. –  Bill Weiss Jul 29 '11 at 20:59
    
Hmm. I don't see anything on there about the feature set of the free one, and I see the language "30 day free trial". I also don't see anything about LDAP on there. Have you used it for a non-AD LDAP server? Do you know what the free version is, compared to the paid? –  Bill Weiss Jul 29 '11 at 21:03
add comment

An alternative to the sequence you give is the LDAP Password Modify Extended Operation, which is supported by modern, professional-quality directory servers. This is an LDAP extended request that changes the password upon being presented with the existing password (as opposed to a reset), and can also request the directory server to generate a password if desired.

share|improve this answer
    
That's not really what I want. There still needs to be a frontend for the non-technical people, right? –  Bill Weiss Jul 29 '11 at 20:59
add comment

Is there any way to lock down phpLDAPadmin for "normal" users to login and manage their own information (I don't know, just a thought)? This might be worth looking into, if you guys use OpenLDAP (of course, I don't know which implementation of LDAP you have...)

I've been doing a lot of theoretical / high-level research on openLDAP recently, and will probably be implementing a new LDAP server w/ phpLDAPadmin soon...

share|improve this answer
    
I don't think so... users can log in to it and modify whatever they have access to, which doesn't really fit my needs. –  Bill Weiss Feb 19 '12 at 3:53
add comment

I don't know of password reset apps, unfortunately. There are a few for changing passwords:

There's admin-ldap in Ruby/Sinatra, ldap_password in Perl/Mojolicious, and ldapchangepw in Python/Flask.

I wasn't happy with the approach admin-ldap or ldap_password took to changing passwords, so I wrote Gente. It uses the Modify Password extended LDAPv3 operation. I would recommend using it or ldapchangepw.

share|improve this answer
    
Looks interesting. In my case I need something to let users reset their password if they've forgotten it, which is missing here. –  Bill Weiss Feb 19 '12 at 3:52
    
Good point. I've clarified my answer. –  sciurus Feb 20 '12 at 15:01
add comment

protected by Iain Feb 20 '12 at 15:18

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.