LDAP Password Modify Extended Operation
Extracted elements (15)
The extended operation was created because standard LDAP update operations (e.g., Modify) act on directory entry attributes and cannot modify passwords when the user has no directory entry, is not represented by a DN, or when passwords are stored outside the directory (e.g., by a SASL service provider such as DIGEST-MD5).
A server MAY choose to advertise the PasswdModifyOID extension in its root DSE only when the client is authorized and/or has established necessary security protections, so clients should not assume absence of the OID means lack of support in all cases.
If a resultCode other than success (0) is indicated in the response, the response field MUST be absent.
If oldPasswd is present and cannot be verified or is incorrect, the server SHALL NOT change the user password. If oldPasswd is absent, the server MAY use other policy to determine whether to change the password.
If the server does not recognize provided fields or does not support the combination of fields provided, it SHALL NOT change the user password.
Servers SHOULD indicate support for this extended operation by providing PasswdModifyOID as a value of the supportedExtension attribute in their root DSE. Clients SHOULD verify server support before attempting the operation.
Servers SHOULD return a non-success resultCode if sufficient security protections are not in place when a Password Modification request is submitted.
The operation SHALL NOT be used anonymously. Clients and servers SHOULD NOT submit or process this operation without adequate security protections in place.
The server SHALL NOT generate a password if the client has provided a newPasswd. Without a client-provided newPasswd, the server SHALL either generate a password or return a non-success result code, and MUST provide the generated password as genPasswd upon success.
The server SHALL only return success upon successfully changing the user's password, and SHALL leave the password unmodified and return a non-success resultCode otherwise.
The userIdentity field, if present, SHALL contain an octet string representation of the user; if absent, the request acts upon the password of the user currently associated with the LDAP session.
The Password Modify operation is an LDAPv3 Extended Operation identified by the OID passwdModifyOID (1.3.6.1.4.1.4203.1.11.1). It allows directory clients to update user passwords independent of the authentication identity form or password storage mechanism.
This extension MUST be used with confidentiality protection such as Start TLS (RFC 2830). The NULL cipher suite MUST NOT be used. The operation itself provides no integrity or confidentiality protection and use without privacy protections may disclose passwords to unauthorized parties.
PasswdModifyRequestValue is an ASN.1 SEQUENCE with three optional fields: userIdentity [0] OCTET STRING, oldPasswd [1] OCTET STRING, and newPasswd [2] OCTET STRING. The request is an ExtendedRequest with requestName set to passwdModifyOID.
PasswdModifyResponseValue is an ASN.1 SEQUENCE with one optional field: genPasswd [0] OCTET STRING. The response is an ExtendedResponse where the responseName field is absent.