diff --git a/server/src/main/java/password/pwm/config/PwmSetting.java b/server/src/main/java/password/pwm/config/PwmSetting.java
index 08212231c..b0c2f3151 100644
--- a/server/src/main/java/password/pwm/config/PwmSetting.java
+++ b/server/src/main/java/password/pwm/config/PwmSetting.java
@@ -303,6 +303,8 @@ public enum PwmSetting
"ldap.ignoreUnreachableProfiles", PwmSettingSyntax.BOOLEAN, PwmSettingCategory.LDAP_GLOBAL ),
LDAP_ENABLE_WIRE_TRACE(
"ldap.wireTrace.enable", PwmSettingSyntax.BOOLEAN, PwmSettingCategory.LDAP_GLOBAL ),
+ LDAP_ALLOW_AUTH_REQUIRE_NEW_PWD(
+ "ldap.allowAuth.requireNewPassword", PwmSettingSyntax.BOOLEAN, PwmSettingCategory.LDAP_GLOBAL ),
PASSWORD_SYNC_ENABLE_REPLICA_CHECK(
"passwordSync.enableReplicaCheck", PwmSettingSyntax.SELECT, PwmSettingCategory.LDAP_GLOBAL ),
@@ -1037,8 +1039,6 @@ public enum PwmSetting
// active directory
AD_USE_PROXY_FOR_FORGOTTEN(
"ldap.ad.proxyForgotten", PwmSettingSyntax.BOOLEAN, PwmSettingCategory.ACTIVE_DIRECTORY ),
- AD_ALLOW_AUTH_REQUIRE_NEW_PWD(
- "ldap.ad.allowAuth.requireNewPassword", PwmSettingSyntax.BOOLEAN, PwmSettingCategory.ACTIVE_DIRECTORY ),
AD_ALLOW_AUTH_EXPIRED(
"ldap.ad.allowAuth.expired", PwmSettingSyntax.BOOLEAN, PwmSettingCategory.ACTIVE_DIRECTORY ),
AD_ENFORCE_PW_HISTORY_ON_SET(
@@ -1047,9 +1047,6 @@ public enum PwmSetting
// active directory
ORACLE_DS_ENABLE_MANIP_ALLOWCHANGETIME(
"ldap.oracleDS.enable.manipAllowChangeTime", PwmSettingSyntax.BOOLEAN, PwmSettingCategory.ORACLE_DS ),
- ORACLE_DS_ALLOW_AUTH_REQUIRE_NEW_PWD(
- "ldap.oracleDS.allowAuth.requireNewPassword", PwmSettingSyntax.BOOLEAN, PwmSettingCategory.ORACLE_DS ),
-
// helpdesk profile
HELPDESK_ENABLE(
@@ -1246,6 +1243,14 @@ public enum PwmSetting
// deprecated.
+
+ // deprecated 2021-01-14
+ AD_ALLOW_AUTH_REQUIRE_NEW_PWD(
+ "ldap.ad.allowAuth.requireNewPassword", PwmSettingSyntax.BOOLEAN, PwmSettingCategory.ACTIVE_DIRECTORY ),
+
+ // deprecated 2021-01-14
+ ORACLE_DS_ALLOW_AUTH_REQUIRE_NEW_PWD(
+ "ldap.oracleDS.allowAuth.requireNewPassword", PwmSettingSyntax.BOOLEAN, PwmSettingCategory.ORACLE_DS ),
// deprecated 2019-06-01
PUBLIC_HEALTH_STATS_WEBSERVICES(
diff --git a/server/src/main/java/password/pwm/ldap/auth/LDAPAuthenticationRequest.java b/server/src/main/java/password/pwm/ldap/auth/LDAPAuthenticationRequest.java
index 1ff1a6666..6ecffce11 100644
--- a/server/src/main/java/password/pwm/ldap/auth/LDAPAuthenticationRequest.java
+++ b/server/src/main/java/password/pwm/ldap/auth/LDAPAuthenticationRequest.java
@@ -250,28 +250,18 @@ private AuthenticationResult authenticateUserImpl(
userIdentity.getLdapProfileID() ).getDirectoryVendor();
if ( PwmError.PASSWORD_NEW_PASSWORD_REQUIRED == e.getError() )
{
- if ( vendor == DirectoryVendor.ACTIVE_DIRECTORY )
- {
- if ( pwmApplication.getConfig().readSettingAsBoolean( PwmSetting.AD_ALLOW_AUTH_REQUIRE_NEW_PWD ) )
- {
- log( PwmLogLevel.DEBUG,
- () -> "auth bind failed, but will allow login due to 'must change password on next login AD error', error: "
- + e.getErrorInformation().toDebugStr() );
- allowBindAsUser = false;
- permitAuthDespiteError = true;
- }
- }
- else if ( vendor == DirectoryVendor.ORACLE_DS )
+
+ if ( pwmApplication.getConfig().readSettingAsBoolean(
+ PwmSetting.LDAP_ALLOW_AUTH_REQUIRE_NEW_PWD )
+ && ( vendor == DirectoryVendor.ACTIVE_DIRECTORY
+ || vendor == DirectoryVendor.ORACLE_DS
+ || vendor == DirectoryVendor.OPEN_LDAP ) )
{
- if ( pwmApplication.getConfig().readSettingAsBoolean(
- PwmSetting.ORACLE_DS_ALLOW_AUTH_REQUIRE_NEW_PWD ) )
- {
- log( PwmLogLevel.DEBUG,
- () -> "auth bind failed, but will allow login due to 'pwdReset' user attribute, error: "
- + e.getErrorInformation().toDebugStr() );
- allowBindAsUser = false;
- permitAuthDespiteError = true;
- }
+ log( PwmLogLevel.DEBUG,
+ () -> "auth bind failed, but will allow login due to 'pwdReset=TRUE' or 'pwdLastSet=0', error: "
+ + e.getErrorInformation().toDebugStr() );
+ allowBindAsUser = false;
+ permitAuthDespiteError = true;
}
}
else if ( PwmError.PASSWORD_EXPIRED == e.getError() )
@@ -279,7 +269,7 @@ else if ( PwmError.PASSWORD_EXPIRED == e.getError() )
// handle ad case where password is expired
if ( vendor == DirectoryVendor.ACTIVE_DIRECTORY )
{
- if ( pwmApplication.getConfig().readSettingAsBoolean( PwmSetting.AD_ALLOW_AUTH_REQUIRE_NEW_PWD ) )
+ if ( pwmApplication.getConfig().readSettingAsBoolean( PwmSetting.LDAP_ALLOW_AUTH_REQUIRE_NEW_PWD ) )
{
if ( !pwmApplication.getConfig().readSettingAsBoolean( PwmSetting.AD_ALLOW_AUTH_EXPIRED ) )
{
diff --git a/server/src/main/resources/password/pwm/config/PwmSetting.xml b/server/src/main/resources/password/pwm/config/PwmSetting.xml
index aefbf4a2f..5abb00e45 100644
--- a/server/src/main/resources/password/pwm/config/PwmSetting.xml
+++ b/server/src/main/resources/password/pwm/config/PwmSetting.xml
@@ -575,6 +575,17 @@
+
+
+ true
+
+
+ true
+
+
+ false
+
+
^[a-zA-Z][a-zA-Z0-9-]*$
@@ -3454,11 +3465,6 @@
true
-
-
- true
-
-
false
@@ -3474,11 +3480,6 @@
true
-
-
- true
-
-
false
@@ -4107,6 +4108,18 @@
+
+ Deprecated
+
+ true
+
+
+
+ Deprecated
+
+ true
+
+
Deprecated
diff --git a/server/src/main/resources/password/pwm/i18n/PwmSetting.properties b/server/src/main/resources/password/pwm/i18n/PwmSetting.properties
index 9500a8c61..349188282 100644
--- a/server/src/main/resources/password/pwm/i18n/PwmSetting.properties
+++ b/server/src/main/resources/password/pwm/i18n/PwmSetting.properties
@@ -463,6 +463,7 @@ Setting_Description_knownLocales=List of locales available. The code is in two
Setting_Description_ldap.ad.allowAuth.expired=Enable this option to have Active Directory fail an LDAP login attempt when the current date is after the user's password expiration date. If you enabled this option, the system allows login even though the LDAP bind failed. The user only can set a new password when this condition occurs. No other functions are available until the user sets the password (and the system clears this flag).
Setting_Description_ldap.ad.allowAuth.requireNewPassword=Enable this option to have Active Directory fail an LDAP login attempt when the users "must change password on next login" flag is set. If you enable this option, the system allows a login even though the LDAP bind failed. The user only can set a new password when this condition occurs. No other functions are available until the password has been set (and the system clears this flag).
Setting_Description_ldap.addObjectClasses=Specify the object classes to automatically add to users who authenticate to the password servlet. Typically, this is an auxiliary LDAP class that contains attributes used by @PwmAppName@ to store password self-service data.
+Setting_Description_ldap.allowAuth.requireNewPassword=Enable this option to allow login by an account that requires a password reset. The user will immediately be required to set a new password. No other functions are available until the password has been set. This functionality is supported for Active Directory, Oracle DS, and OpenLDAP with the ppolicy module.
Setting_Description_ldap.ad.enforcePwHistoryOnSet=Enable this option to enforce the password policy during forgotten password when Use Proxy When Password Forgotten is also set to true. This setting requires that the Active Directory servers be at Windows 2008 Server R2 SP1 or later. More specifically, it requires that the Active Directory servers support the LDAP_SERVER_POLICY_HINTS_OID (1.2.840.113556.1.4.2066) LDAP modification control.
Setting_Description_ldap.ad.proxyForgotten=Enable this option to have @PwmAppName@ use the LDAP proxy account for LDAP work when the users' forget their passwords. This is because an LDAP connection is not possible to Active Directory without the users' passwords. When authenticated in this condition, Active Directory forces the users to change their passwords immediately.
Setting_Description_ldap.defaultObjectClasses=Specify the object classes of user entries in your LDAP directory.
@@ -997,6 +998,7 @@ Setting_Label_knownLocales=Locales (Languages) and Flags
Setting_Label_ldap.ad.allowAuth.expired=Allow Authentication When Password Expired
Setting_Label_ldap.ad.allowAuth.requireNewPassword=Allow Authentication When "Must Change Password On Next Login" Is Set
Setting_Label_ldap.addObjectClasses=Auto Add Object Classes
+Setting_Label_ldap.allowAuth.requireNewPassword=Allow Authentication When "Must Change Password On Next Login" Is Set
Setting_Label_ldap.ad.enforcePwHistoryOnSet=Enforce Password Policy During Forgotten Password
Setting_Label_ldap.ad.proxyForgotten=Use Proxy When Password Forgotten
Setting_Label_ldap.defaultObjectClasses=User Object Class