Unable to change user's password (Active Directory)

[dsbenghe]

Unable to change user's password (Active Directory)

[gerwim]

I managed to fix this by doing the following:

Instead of:

string password = "\"myNewStrongPassword\"";
byte[] encodedBytes = Encoding.Unicode.GetBytes(password);
string encodedTxt = Convert.ToBase64String(encodedBytes);

Convert it to sbyte (and drop the string and base64 encoding):

string password = "\"myNewStrongPassword\"";
sbyte[] encodedBytes = SupportClass.ToSByteArray(Encoding.Unicode.GetBytes(password));
LdapAttribute deletePassword = new LdapAttribute("unicodePwd", encodedBytes);

[ysakiyev]

Just in case if someone is facing problems, here is the working code
var sbytes = Encoding.Unicode.GetBytes($@"""{password}"""); var attributePassword = new LdapAttribute("unicodePwd", sbytes); adConnect.Modify(user.Dn, new LdapModification(LdapModification.Replace, attributePassword));

and make sure you are connecting SSL 636

[cjag74]

Did below and it worked!

First, install SSL cert in AD then reboot AD server
https://www.manageengine.com/products/active-directory-audit/kb/how-to/how-to-install-ssl-certificates-in-active-directory.html

Second, verify LDAPS connection

After a certificate is installed, follow these steps to verify that LDAPS is enabled:
Start the Active Directory Administration Tool (Ldp.exe).
On the Connection menu, click Connect.
Type the name of the domain controller to which you want to connect.
Type 636 as the port number.
Click OK.
RootDSE information should print in the right pane, indicating a successful connection.

Third, install the NuGet package System.DirectoryServices.Protocols and use code below

using System.DirectoryServices.Protocols;
public async Task OnPostSubmit()
{

    var ldapConnection = new LdapConnection(new LdapDirectoryIdentifier("abc.com", 636, true, false));
        ldapConnection.AuthType = AuthType.Basic;
        ldapConnection.SessionOptions.VerifyServerCertificate = new VerifyServerCertificateCallback((con, cer) => true);
        ldapConnection.SessionOptions.SecureSocketLayer = true;
        ldapConnection.Credential = new NetworkCredential("abc\\abcadmin", "AdminPassw0rd");
        ldapConnection.Bind();

        // Set the new password for the user
        string password = "NewPassw0rd";
        byte[] encodedPassword = Encoding.Unicode.GetBytes($@"""{password}""");

        DirectoryAttributeModification dirmod = new DirectoryAttributeModification();
        dirmod.Operation = DirectoryAttributeOperation.Replace;
        dirmod.Name = "unicodePwd";
        dirmod.Add(encodedPassword);

        ModifyRequest request = new ModifyRequest("CN=UserToChangeFor,CN=Users,DC=abc,DC=com", dirmod);

        // Execute the request to reset the password
        ModifyResponse response = (ModifyResponse)ldapConnection.SendRequest(request);

        return Page();

}

[maxis777]

Hi guys,

I steel have the same issue and cannot fix it...
I connect to LDPA using SSL and after i can get infos from AD create OU etc
But when i try to create a user i receive the same error as described in this topic.

0000001F: SvcErr: DSID-031A1254, problem 5003 (WILL_NOT_PERFORM), data 0

Creation of user without password working well...

Thanks

There are the code that i use to connect to AD:

1. Connection

LdapConnection conn = new LdapConnection();
 conn.SecureSocketLayer = true;
conn.UserDefinedServerCertValidationDelegate += (sender, certificate, chain, sslPolicyErrors) => true; 
conn.Connect(this.ADExtHost, 636);
conn.Bind(LdapConnection.Ldap_V3, this.ADExtLogin, this.ADExtPassword);

2. Adding user to AD

LdapAttributeSet attributeSet = new LdapAttributeSet();
attributeSet.Add(new LdapAttribute("userPrincipalName", username + "_" + domain + "@external.local"));
attributeSet.Add(new LdapAttribute("mail", user.Email));
attributeSet.Add(new LdapAttribute("objectClass", new string[] { "user", "organizationalPerson", "person", "top" }));
attributeSet.Add(new LdapAttribute("name", user.Email));

sbyte[] encodedBytes = SupportClass.ToSByteArray(Encoding.Unicode.GetBytes(password));
attributeSet.Add(new LdapAttribute("unicodePwd", encodedBytes));

attributeSet.Add(new LdapAttribute("userAccountControl", "544"));

 //DN of the entry to be added
string dn = $"cn={user.Email}," + container;
LdapEntry newEntry = new LdapEntry(dn, attributeSet); 

//Add the entry to the directory
connection.Add(newEntry);

[leo9223]

For me this is working

var bytes = Encoding.ASCII.GetBytes(newPassword);

var sbytes = bytes.Select(b => Convert.ToSByte(b)).ToArray();

LdapAttribute attribute = new LdapAttribute("userPassword", sbytes);

[xrkolovos]

This Code didn't work.

var bytes = Encoding.ASCII.GetBytes(newPassword);
var sbytes = bytes.Select(b => Convert.ToSByte(b)).ToArray();
LdapAttribute attribute = new LdapAttribute("userPassword", sbytes);

I get error "No Such Attribute"

00002085: AtrErr: DSID-031525C6, #1:
	0: 00002085: DSID-031525C6, problem 1001 (NO_ATTRIBUTE_OR_VAL), data 0, Att 23 (userPassword):len 12

With This Code

LdapModification[] modifications = new LdapModification[2];
//
sbyte[] encodedBytesOldPass = SupportClass.ToSByteArray(Encoding.Unicode.GetBytes("\"" + oldPassword + "\""));
LdapAttribute deletePassword = new LdapAttribute("unicodePwd", encodedBytesOldPass);
modifications[0] = new LdapModification(LdapModification.DELETE, deletePassword);
//
sbyte[] encodedBytesNewPass = SupportClass.ToSByteArray(Encoding.Unicode.GetBytes("\"" + newPassword + "\""));
LdapAttribute addPassword = new LdapAttribute("unicodePwd", encodedBytesNewPass);
modifications[1] = new LdapModification(LdapModification.ADD, addPassword);

connection.Modify(UserToChange, modifications);

Still doen't work. I get "Constraint Violation"

0000052D: AtrErr: DSID-03190FD6, #1:
	0: 0000052D: DSID-03190FD6, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 9005a (unicodePwd)

[gokulm]

Enclosing the password within double quotes is IMPORTANT.

string password = "\"myNewStrongPassword\""; byte[] encodedBytes = Encoding.Unicode.GetBytes(password); string encodedTxt = Convert.ToBase64String(encodedBytes);

[USFbobFL]

I managed to fix this by doing the following:

Instead of:

string password = "\"myNewStrongPassword\"";
byte[] encodedBytes = Encoding.Unicode.GetBytes(password);
string encodedTxt = Convert.ToBase64String(encodedBytes);

Convert it to sbyte (and drop the string and base64 encoding):

string password = "\"myNewStrongPassword\"";
sbyte[] encodedBytes = SupportClass.ToSByteArray(Encoding.Unicode.GetBytes(password));
LdapAttribute deletePassword = new LdapAttribute("unicodePwd", encodedBytes);

thanks, but still getting this:
Unwilling To Perform 0000001F: SvcErr: DSID-031A12D2, problem 5003 (WILL_NOT_PERFORM), data 0 �

[USFbobFL]

For me this is working

var bytes = Encoding.ASCII.GetBytes(newPassword);

var sbytes = bytes.Select(b => Convert.ToSByte(b)).ToArray();

LdapAttribute attribute = new LdapAttribute("userPassword", sbytes);

While this method does not generate an error, it also does not update the password.

[Legolas53723]

Hi there
on my case using the above code I'm facing the same issue :(
About the user.Dn is like this --> “cn= firstname.lastname,o=organizationunit,c=us”

Thanks in Advance

[bbteam17]

this is working for me (Active directory ). I tested .
conn.Modify(user.Dn, new LdapModification(LdapModification.Replace, new LdapAttribute("unicodePwd", Encoding.Unicode.GetBytes($@"""{password}"""))));