Change password in Active Directory using the JNDI GSS-API/Kerberos

Question

Hi
I am trying to the JNDI GSS-API to change a user password.
When I actually try to change the password using ctx.modifyAttributes(userName, mods), I get the exception:
09:39:38,163 ERROR [STDERR] javax.naming.OperationNotSupportedException: [LDAP: error code 53 - 0000001F: SvcErr: DSID-031A0FC0, problem 5003 (WILL_NOT_PERFORM), data 0 ]; remaining name 'CN=USER,OU=Usuarios,DC=testead,DC=br'
Here's my java code:
public class ChangePasswordLDAPCommand implements Command {
     static Logger logger = Logger.getLogger(ChangePasswordLDAPCommand.class.getName());
     @SuppressWarnings("unchecked")
     public boolean execute(org.apache.commons.chain.Context context) throws ApplicationException {
          logger.info("Início - execute");
          try {
               CoreConfig config = CoreConfig.getInstance();
               String userName = config.getProperty(CoreConfig.PARAM_CONFIG_LDAP_ADMIN_NAME);
               char[] password = config.getProperty(CoreConfig.PARAM_CONFIG_LDAP_ADMIN_PASSWORD).toCharArray();
               Subject subject = new Subject();
               Krb5LoginModule krb5LoginModule = new Krb5LoginModule();
               Map<String, String> map = new HashMap<String, String>();
               Map<String, String> shared = new HashMap<String, String>();
               map.put("com.sun.security.auth.module.Krb5LoginModule","required");
               map.put("client","true");
               map.put("useTicketCache","true");
               map.put("doNotPrompt","true");
               map.put("useKeyTab","true");
               map.put("useFirstPass","true");
               map.put("refreshKrb5Config","true");
               logger.info(">>>>> map.toString(): "+map.toString());
               shared.put("javax.security.auth.login.name", config.getProperty(CoreConfig.PARAM_CONFIG_LDAP_ADMIN_NAME));
               shared.put("javax.security.auth.login.password", config.getProperty(CoreConfig.PARAM_CONFIG_LDAP_ADMIN_PASSWORD));
               shared.put("javax.net.debug","SSL,handshake,trustmanager");
               shared.put("sun.security.krb5.debug","true");
               shared.put("com.sun.jndi.ldap.connect.pool.timeout","30000");
               logger.info(">>>>> shared.toString(): "+shared.toString());
               krb5LoginModule.initialize(subject, new UserNamePasswordCallbackHandler(userName,password),shared,map);
               krb5LoginModule.login();
               if(krb5LoginModule.commit()){
                    //Recupera o usuario a ser alterado
                    UsuarioTOLDAP usuarioTO = (UsuarioTOLDAP) context.get(CoreConfig.USUARIO_TO_LDAP);
                    logger.info(">>>>>>>>>>>>>>>>>>>>>> subject.toString(): "+subject.toString());
                    Subject.doAsPrivileged(subject, new JndiAction(usuarioTO), null);
          } catch (LoginException e) {
               e.printStackTrace();
          } catch (PrivilegedActionException e) {
               e.printStackTrace();
          logger.info("Fim - execute");
          return Command.CONTINUE_PROCESSING;
@SuppressWarnings("unchecked")
public class JndiAction implements java.security.PrivilegedExceptionAction{
     private static Logger logger = Logger.getLogger(JndiAction.class.getName());
     private UsuarioTOLDAP usuarioTOLDAP = null;
     public JndiAction(UsuarioTOLDAP usuarioTO) {
          this.usuarioTOLDAP = usuarioTO;
     public Object run() {
          performJndiOperation(usuarioTOLDAP);
          return null;
     @SuppressWarnings("unchecked")
     private static void performJndiOperation(UsuarioTOLDAP usuarioTOLDAP){
          logger.info(">>>>> entrei na JndiOperation");
          try {
               CoreConfig config = CoreConfig.getInstance();          
               String distinguishedName = "";
               String keystore = "C:/Documents and Settings/user/.keystore";
               System.setProperty(CoreConfig.JAVAX_NET_SSL_TRUSTSTORE,keystore);
               System.setProperty("com.sun.jndi.ldap.connect.pool.timeout","30000");
               System.setProperty("javax.net.debug","all");
               System.setProperty("sun.security.krb5.debug","true");
               Hashtable env = new Hashtable();
               env.put(Context.INITIAL_CONTEXT_FACTORY, CoreConfig.INITIAL_CONTEXT_FACTORY);
               env.put(Context.PROVIDER_URL, config.getProperty(CoreConfig.PARAM_CONFIG_LDAP_URL));
               env.put(Context.SECURITY_AUTHENTICATION, CoreConfig.SECURITY_PROTOCOL_GSSAPI);
               env.put(Context.SECURITY_PRINCIPAL, config.getProperty(CoreConfig.PARAM_CONFIG_LDAP_ADMIN_NAME));
               env.put(Context.SECURITY_CREDENTIALS, config.getProperty(CoreConfig.PARAM_CONFIG_LDAP_ADMIN_PASSWORD));
               env.put(CoreConfig.JAVAX_NET_SSL_TRUSTSTORE,keystore);
               env.put("javax.security.sasl.qop","auth-int");
               env.put("javax.security.sasl.strength","high");
               env.put("javax.security.sasl.server.authentication","true");
              String userName = "CN=USER,"+config.getProperty(CoreConfig.PARAM_CONFIG_LDAP_BASE_DN);
               // Cria o contexto inicial de acesso ao LDAP
               //DirContext ctx = new InitialDirContext(env);
               // Create the initial directory context
               LdapContext ctx = new InitialLdapContext(env,null);
               //set password is a ldap modfy operation
               ModificationItem[] mods = new ModificationItem[1];
               //Replace the "unicdodePwd" attribute with a new value
               //Password must be both Unicode and a quoted string
               String newQuotedPassword = "\"" + usuarioTOLDAP.getNovaSenha() + "\"";
               byte[] newUnicodePassword = newQuotedPassword.getBytes("UTF-16LE");
               mods[0] = new ModificationItem(DirContext.REPLACE_ATTRIBUTE, new BasicAttribute("unicodePwd", newUnicodePassword));
               // Perform the update
               ctx.modifyAttributes(userName, mods);
               ctx.close();
          } catch (NamingException e1) {
               e1.printStackTrace();
          } catch (UnsupportedEncodingException e) {
               e.printStackTrace();
          } catch (IOException e) {
               // TODO Auto-generated catch block
               e.printStackTrace();
}Edited by: c0m4nch3 on Jan 21, 2010 12:13 PM

Answer 1

Refer to my response for a similar question in http://forums.sun.com/thread.jspa?threadID=5416736
Also the following may be related: http://forums.sun.com/thread.jspa?threadID=5196192
Good luck.