15

It seems like every shop that uses LDAP at some point has to cobble together something to let users reset their passwords without bothering the IT staff. The workflow almost always looks like:

  1. User gives username (jblow)
  2. Email jblow@company a link
  3. User clicks link, puts in a new password

On the backend, that corresponds to:

  1. Web form gets a username, stores (username, big unique string) in a DB, emails big unique string to username@company
  2. Other form has a click on https://site/pwreset/big unique string , uses that to authenticate the user, changes their password

Right? So, has someone written one of these that they share? I'd rather use one that's had a bit more thought put into it than the 10 minute job everyone seems to do.

I did a quick search of Sourceforge, Freshmeat etc and didn't find anything that wasn't abandoned.

10
  • 4
    Why do your users have LDAP passwords that are different from their email passwords?
    – 84104
    Jul 29, 2011 at 23:07
  • Do you want "reset when user has forgotten" or "periodic change"? They're two quite different requirements, and in a corporate environment I don't think I'd really want to let people reset passwords automatically when they forget them. At any rate, most places probably roll their own because integrating all the password-related policies into a standard tool is just too much effort.
    – womble
    Jul 30, 2011 at 1:03
  • user84104: Different environments. Email is in the office, LDAP is in our production site. We don't want production things authing to the office, because it would be bad if production went down because the office was being worked on :)
    – Bill Weiss
    Jul 30, 2011 at 14:51
  • Womble: Really? Assuming we auth them in some manner (such as access to email, which is a different pw, etc), why not let them reset their passwords?
    – Bill Weiss
    Jul 30, 2011 at 14:51
  • @Bill: did you find anything useful? I need to do the same thing.
    – Jason S
    Sep 28, 2011 at 22:05

7 Answers 7

6

We use horde for password changes, but not sure if it can fit the workflow you want.

5
  • I'll take a look.
    – Bill Weiss
    Jul 29, 2011 at 20:59
  • It looks like it would be a pretty huge install to just do password changes. Is there a component that does that that I don't see?
    – Bill Weiss
    Jul 29, 2011 at 21:43
  • 3
    horde.org/apps/passwd
    – churnd
    Aug 23, 2011 at 20:18
  • Oh, ok. How did I miss that? Thanks!
    – Bill Weiss
    Aug 24, 2011 at 1:45
  • Did it work out for you?
    – churnd
    Sep 2, 2011 at 17:17
4

This isn't the best documented project, but it has the advantage of being fairly simple PHP with a couple of installers for various linux flavors that get it up and running fast:

http://ltb-project.org/wiki/documentation/self-service-password/

If you are concerned about security, my recommendation is to use a more fully supported widely used package, since I don't know how well this project has been put through its paces.

1
  • Hey, that looks pretty good! I'll give it a shot.
    – Bill Weiss
    Sep 26, 2011 at 22:29
1

phpLdapPasswd, but it is no longer being maintained.

1
  • Yeah, I saw that one, but the big "HEY, NO ONE CARES FOR THIS CODE ANYMORE" always worries me.
    – Bill Weiss
    Jul 29, 2011 at 20:58
1

ADSelfService Plus from ManageEngine is available in a free version. You'll have to check it out for yourself to determine the limitations of the free version to see if it fits your needs.

2
  • I'll take a look.
    – Bill Weiss
    Jul 29, 2011 at 20:59
  • Hmm. I don't see anything on there about the feature set of the free one, and I see the language "30 day free trial". I also don't see anything about LDAP on there. Have you used it for a non-AD LDAP server? Do you know what the free version is, compared to the paid?
    – Bill Weiss
    Jul 29, 2011 at 21:03
0

An alternative to the sequence you give is the LDAP Password Modify Extended Operation, which is supported by modern, professional-quality directory servers. This is an LDAP extended request that changes the password upon being presented with the existing password (as opposed to a reset), and can also request the directory server to generate a password if desired.

1
  • That's not really what I want. There still needs to be a frontend for the non-technical people, right?
    – Bill Weiss
    Jul 29, 2011 at 20:59
0

Is there any way to lock down phpLDAPadmin for "normal" users to login and manage their own information (I don't know, just a thought)? This might be worth looking into, if you guys use OpenLDAP (of course, I don't know which implementation of LDAP you have...)

I've been doing a lot of theoretical / high-level research on openLDAP recently, and will probably be implementing a new LDAP server w/ phpLDAPadmin soon...

1
  • I don't think so... users can log in to it and modify whatever they have access to, which doesn't really fit my needs.
    – Bill Weiss
    Feb 19, 2012 at 3:53
0

I don't know of password reset apps, unfortunately. There are a few for changing passwords:

There's admin-ldap in Ruby/Sinatra, ldap_password in Perl/Mojolicious, and ldapchangepw in Python/Flask.

I wasn't happy with the approach admin-ldap or ldap_password took to changing passwords, so I wrote Gente. It uses the Modify Password extended LDAPv3 operation. I would recommend using it or ldapchangepw.

2
  • Looks interesting. In my case I need something to let users reset their password if they've forgotten it, which is missing here.
    – Bill Weiss
    Feb 19, 2012 at 3:52
  • Good point. I've clarified my answer.
    – sciurus
    Feb 20, 2012 at 15:01

Not the answer you're looking for? Browse other questions tagged .