eDirectory has a number of restricts that prevent password modification. The user can have insufficient rights for the following reasons:
The user is not a supervisor of the entry.
The flag that allows user to change the password is false.
The password unique flag is true and the password supplied is matches a previous password.
A minimum length for the password has been set and the password is too short.
The user did not supply the old password value with the new value in the same operation.
Passwords in eDirectory are stored as RSA public and private key pairs. The Novell LDAP server uses the userPassword attribute to generate these key pairs for an LDAP client.
NDS 8.17 or higher is required for users to change their own passwords.
NDS 7.xx is required for an administrator to change user passwords.
If the user has sufficient rights, the process is similar to modifying any attribute of an entry. For a user to change his or her own password, complete the following steps.
Create two LDAPMod structures for the userPassword attribute.
In the first LDAPMod structure, set the modification operation to LDAP_MOD_DELETE, the modification type to "userPassword", and the value to the current password.
In the second LDAPMod structure, set the modification operation to LDAP_MOD_ADD, the modification type to "userPassword", and the value to the new password.
Add the structures to a NULL-terminated array of LDAPMod structures.
Call ldap_modify_ext_s to modify the specified entry's password.
For sample code that allows a user to change his or her password, see modpass.c
For sample code that allows an administrator to set a password, see setpass.c.
The user can also change the password in one LDAP modification. To change the password in a single operation:
dn: cn=test,o=org changetype: modify delete: userpassword userpassword: pass - add: userpassword userpassword: password