Feature #18934


Support LDAP Password Changing

Added by Chris Bush over 9 years ago. Updated over 8 years ago.

Target version:
Start date:
Due date:
% Done:


Estimated time:


It would be swell if Redmine supported changing LDAP/AD passwords from the UI, especially in the case of passwords that have expired where the user has no way to change it otherwise. I've done some preliminary modifications of account_controller.rb and user.rb to detect when a user's password must be changed, which I can attach as a patch if it's helpful.

Related issues

Has duplicate Redmine - Defect #19165: LDAP managment with REDMINE - Password expiredClosed

Is duplicate of Redmine - Patch #5690: Change LDAP passwordNew2010-06-15

Actions #1

Updated by Toshi MARUYAMA over 9 years ago

  • Category changed from Accounts / authentication to LDAP
Actions #2

Updated by Jean-Philippe Lang about 9 years ago

  • Has duplicate Defect #19165: LDAP managment with REDMINE - Password expired added
Actions #3

Updated by S├ębastien ZAJAC about 9 years ago


Could you attach the patched file?

Actions #4

Updated by Toshi MARUYAMA about 9 years ago

  • Priority changed from High to Normal
Actions #5

Updated by Chris Bush about 9 years ago

Unfortunately my fix worked for detecting an expired password, but I couldn't get the actual change working in a secure manner. The issue lies in the fact that the LDAP implementation won't allow a bind for an expired account, and so you can't bind the user to change their password. The authentication flag that gets returned for an expired password appears to be the same as what you get for an authentication failure, which means you can't authenticate the user to change their password. It would be a security issue to just blindly change the password using the LDAP admin username/password. I can still attach the patch file if you want, but I think the issue lies in net-ldap.

Actions #6

Updated by Olivier Houdas almost 9 years ago

One of our users came across this issue (could not login to Redmine, because his password had expired after his morning login to the network), so I looked at this issue.

It would still be interesting to inform the user properly that his/her password has expired. He can then simply change it on his computer.

However, LDAP programmers advise to use the pwdLastReset and pwdMaxAge attributes (domain level) to calculate whether a password has expired or not.
Unfortunately, it seems that there is no official naming rule, and that it would be pwdMaxAge with Oracle products, and maxPwdAge with Microsoft's Active directory.

Would your patch work for all LDAP providers? Maybe it would still be interesting to use it if so.

Actions #7

Updated by Fernando Hartmann over 8 years ago

Related to #5690 ?

Actions #8

Updated by Toshi MARUYAMA over 8 years ago

  • Status changed from New to Closed
  • Resolution set to Duplicate

Fernando Hartmann wrote:

Related to #5690 ?

Thank you for your pointing out.

Actions #9

Updated by Toshi MARUYAMA over 8 years ago

  • Is duplicate of Patch #5690: Change LDAP password added

Also available in: Atom PDF