Active Directory Authentication - password reset not working correctly PLEASE HELP!

[jarice1978]

Hello,

I have been scanning the internet for a few days now. That is not working. So now it is time to post!

I have read a few other posts on here about authentication but they do not match exactly.

We currently have an intranet app built in a mixture of asp and asp.net 1.1 and 2.0 written in VB .Net. We have a form where the user logs in and it authenticates against active directory successully in 2 ways:

1. The admin resets the password and the user logs in using that password (not forced to change)

2. The user changes their password themselves.


HOWEVER

When the admin resets the password and checks the box to "force the password change" the application does not work. Here is the code that is causing the problem (specifically the DirectoryEntry, that is where the code fails). I have walked through the debugger and the code works fine for the 2 conditions I described above, but returns a the following error message when the password is reset and the user is "forced" to change their password:

{"Logon failure: unknown user name or bad password."}

Public Function IsAuthenticated(ByVal strUserId As String, _
                                        ByVal strPassword As String) As Boolean
 
            Dim strDomainAndUsername As String = strDomain & "\" & strUserId
            entry = New DirectoryEntry(adPath, strDomainAndUsername, strPassword, AuthenticationTypes.Secure)
 
            Try
                Dim search As DirectorySearcher = New DirectorySearcher(entry)
 
                search.Filter = "(SAMAccountName=" & strUserId & ")"
                search.PropertiesToLoad.Add("cn")
                Dim result As SearchResult = search.FindOne()
 
                If (result Is Nothing) Then
                    Return False
                End If
 
            Catch ex As Exception
                Throw New Exception("Error authenticating user. " & ex.Message)
            End Try
 
            Return True
        End Function
 

Please, any help with this would be greatly appreciated. It is a requirment of my company to force the password change after a user's password is reset. Not complying could mean big problems.



Thanks for your time,

Joe


Also, if there is any documentation that explains this better please let me know. What I have learned about Active Directory and authentication has been random posts and articles on the internet over the past few days.

[kenobewan]

Welcome to the site. I believe that either the admin account is locked or the credentials are incorrect. I have paid the price recently for not having a test admin account, as failed tests were locking the live admin account :|.

I'd suggest getting a book or doing a course - I agree resources for AD on the net aren't great. HTH.

[jarice1978]

Thanks a million for replying! I have been monitoring this thread like a hawk!


Not sure I understand you response.

What admin account is locked.


Right now this is how it works. Admins on my team get requests from users to reset their passwords. They then login and reset the user's password via a tool called URMA(home grown tool).

The user will then try to login as normal. When a user logs in the code above gets executed. Specifically this line:

entry = New DirectoryEntry(adPath, strDomainAndUsername, strPassword, AuthenticationTypes.Secure) 

When the admin resets a users password and does not force them to change their password (does not check the checkbox in the tool), the user can login fine and the line of code above does not have any problems.

HOWEVER

If the admin checks the box to "force a password change" the line of code above fails with :

{"Logon failure: unknown user name or bad password."}

The DirectoryEntry initialization is not performing any admin modifications at this point. I beleive it is merely validating that the user and password are valid.



We have noticed one thing that could possibly be causing this. When the admin resets the password WITHOUT "forcing the user to change password" the value of the property pwdLastSet contains an actual date.

When the admin "forces a password change" the pwdLastSet value is null or "no value set". Could this be the culprit?

I only suspect this because out of the many posts I have looked at, when a developer wants to force a user to change their password within the code they are doing something like this:

user.Put("pwdLastSet", 0)
 

So, now that I am on a tangent would the fact that there is no value set in pwdLastSet for a user be causing the DirectoryEntry initialization to fail with the
error:
{"Logon failure: unknown user name or bad password."}

???


Thanks again,

Joe

[kenobewan]

Hi Joe,

Obviously, I've never used your URMA tool but assume that it is a .NET application and works similarly to the AD applications that I work with. We have been going through a .NET 2 upgrade and I had to test our applications with new LDAP strings. I got locked out a couple of times as a consequence (same error message).

My suggestion is to get your Active Directory admin to check the account(s) used by your local admins who use the tool. In the tool, there are I assume different scripts being called depending on whether the checkbox is checked or not. Whether they use different connection strings or different credentials or the account is locked, I believe that this is where the problem lies. HTH.

[jarice1978]

Well that would make sense.

What doesn't make sense though, is that we can login through our citirx web interface and it works correctly. By this I mean that when the admin forces the change in our URMA tool, the user can login through citrix and it immedietly directs them to change their password like it should.

So this would point back to the code I am working with...

[kenobewan]

Your LDAP connection using AuthenticationT ypes is .NET 2. The problem appears to be a schema caching problem, which is a fancy way of saying if your login fails it falls back to anonymous connection with only LDAP version 2 available. I would predict that this means that you can still connect, as you have discovered, but certain fields e.g. samaccountname may write as system.byte[].

Please follow these steps:
1. Have the admin accounts checked to see if they are locked.
2. Have the admin accounts credentials checked.

I wasted time playing with the code when I had a problem. Lets rule out the problem I am referring to. Thanks.

[kenobewan]

BTW - reread your posts to check that I am not missing anything. If pwdLastSet was null I would expect a null exception error when the admin tried to force the change. You are right that it is strange that it is working in citrix, that I can't explain :(.