Troubleshooting: AD LDS Rejects a New or Reset Password

Version Affected: All
 
 

Overview

When using AD LDS (Active Directory Lightweight Directory Services) as a datastore, SecureAuth can fail to set a password — either while creating a new user, or while resetting an existing user's password. There is more than one possible cause:

• See Cause 1 - The password doesn't meet AD LDS's password complexity requirements.
• See Cause 2 - AD LDS blocks the password operation because the connection isn't encrypted.

In this article

• Cause 1: Password Does Not Meet Complexity Requirements
• Cause 2: Connection to AD LDS Is Not Encrypted

Cause 1: Password Does Not Meet Complexity Requirements

By default, an AD LDS instance enforces any local or domain password complexity policy that exists on the Windows Server it runs on. If the password being set doesn't meet those complexity rules, AD LDS rejects it.

Resolution 1:

Confirm the password being entered complies with the AD LDS server's password complexity requirements. For more information, see Microsoft's Enforcing Strong Password Usage Throughout Your Organization.

Cause 2: Connection to AD LDS Is Not Encrypted

By default, AD LDS does not allow a user's password to be created or reset over an unencrypted connection. When this is the cause, resetting a password over a plain LDAP connection (for example, through LDP) fails with:

Illegal modify operation. Some aspect of the modification is not permitted.

Resolution 2:

Configure AD LDS to use an LDAP over SSL (LDAPS) connection, which requires a certificate to be in place. See Microsoft's Configuring LDAP over SSL Requirements for AD LDS for the certificate setup steps.

If you cannot use LDAPS, you have two other options, both with tradeoffs:

• Disable the secure-channel requirement, so passwords can be created/reset over the existing unencrypted connection:
  1. Start ADSI Edit and connect to the AD LDS instance's Configuration partition.
  2. Navigate to CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,CN={GUID of the AD LDS instance}.
  3. Right-click CN=Directory Service and select Properties.
  4. Double-click the dSHeuristics attribute.
  5. Set the value to 0000000001001 and click OK, then click OK again to close the properties box.
  Do not use this option in a production environment — it means the password can be read from the network.
• Configure anonymous LDAP binding to the AD LDS instance, which allows SecureAuth to create/reset a password over an unencrypted connection. Never grant anonymous access to any portion of your AD LDS instance for any other purpose.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.