Redmine

Hello

Could you attach the patched file?

Unfortunately my fix worked for detecting an expired password, but I couldn't get the actual change working in a secure manner. The issue lies in the fact that the LDAP implementation won't allow a bind for an expired account, and so you can't bind the user to change their password. The authentication flag that gets returned for an expired password appears to be the same as what you get for an authentication failure, which means you can't authenticate the user to change their password. It would be a security issue to just blindly change the password using the LDAP admin username/password. I can still attach the patch file if you want, but I think the issue lies in net-ldap.

One of our users came across this issue (could not login to Redmine, because his password had expired after his morning login to the network), so I looked at this issue.

It would still be interesting to inform the user properly that his/her password has expired. He can then simply change it on his computer.

However, LDAP programmers advise to use the pwdLastReset and pwdMaxAge attributes (domain level) to calculate whether a password has expired or not.
Unfortunately, it seems that there is no official naming rule, and that it would be pwdMaxAge with Oracle products, and maxPwdAge with Microsoft's Active directory.

Would your patch work for all LDAP providers? Maybe it would still be interesting to use it if so.

+1
Related to #5690 ?