OAM - How to enable pwd change when pwd expired in ADAM directory

Question

For self-service password changes through Oracle Access Manager (OAM), OAM will validate the current password using an LDAP bind, and then set the new password. This is fine for a user with a valid current password, but we often have users whose passwords have expired in the directory (Microsoft ADAM) and therefore the bind will fail. This means that users whose passwords have already expired have to go through the "lost password" page (with questions and answers) instead of the usual password change page with just old+new passwords. Unfortunately, this results in help desk calls for users who are unable to remember their questions and answers (probably since they don't use them very often).
What we would like to do is allow users with expired passwords to use the standard password change page.
One possibility, of course, is to turn off password expiration at the directory level and just use OAM's password expiration. However, we have many applications (internal and third-party) that are not behind OAM, but connect directly to the ADAM directory. Turning off native password expiration in the directory would open up a hole, allowing users with expired passwords to continue using those applications.
Before we implemented OAM, we had a custom web page that called the native ADAM/AD ChangePassword method via ADSI, which does work for users with expired passwords. The ADSI method will verify that the current password matches, even if it's expired, and set the new password. We could go back to this custom page, but then the new password is not added to the OAM password history in the obPasswordHistory attribute.
Any ideas for the best way to do this? I don't mind writing custom code, but I want to integrate well with the rest of the OAM password functionality, while avoiding any messy hacks if possible...
Thanks,
Matthew

Answer 1

I think we've already implemented the solution you're describing. We have a custom authentication plugin configured in the Access Server that is able to detect an expired ADAM password and redirect the user.
The problem comes after that. We can redirect the user to the standard Identity Server password change page (/identity/oblix/apps/lost_pwd_mgmt/bin/lost_pwd_mgmt.cgi?program=redirectforchangepwd), where the user enters the old password and new password. However, this page will not allow the user to change the password, because the first thing the Identity Server does is attempt an LDAP bind in order to validate the old password, and a bind won't work.
One thing that I know of that will work, while still validating the old password, is the ADSI ChangePassword method. If I can somehow configure a custom plugin in the Identity Server to call this method instead of the built-in functionality for password changes, that would solve the problem.
Thanks,
Matthew