LDAP Password Modify Extended Operation (RFC3062)
Original Publication Date: 2001-Feb-01
Included in the Prior Art Database: 2019-Feb-14
Internet Society Requests For Comment (RFCs)
This document describes an LDAP extended operation to allow modification of user passwords which is not dependent upon the form of the authentication identity nor the password storage mechanism used. [STANDARDS-TRACK]
Network Working Group K. Zeilenga Request for Comments: 3062 OpenLDAP Foundation Category: Standards Track February 2001
LDAP Password Modify Extended Operation
Status of this Memo
This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited.
Copyright (C) The Internet Society (2001). All Rights Reserved.
The integration of the Lightweight Directory Access Protocol (LDAP) and external authentication services has introduced non-DN authentication identities and allowed for non-directory storage of passwords. As such, mechanisms which update the directory (e.g., Modify) cannot be used to change a user’s password. This document describes an LDAP extended operation to allow modification of user passwords which is not dependent upon the form of the authentication identity nor the password storage mechanism used.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", and "MAY" in this document are to be interpreted as described in RFC 2119.
1. Background and Intent of Use
Lightweight Directory Access Protocol (LDAP) [RFC2251] is designed to support an number of authentication mechanisms including simple user name/password pairs. Traditionally, LDAP users where identified by the Distinguished Name [RFC2253] of a directory entry and this entry contained a userPassword [RFC2256] attribute containing one or more passwords.
The protocol does not mandate that passwords associated with a user be stored in the directory server. The server may use any attribute suitable for password storage (e.g., userPassword), or use non- directory storage.
Zeilenga Standards Track [Page 1]
RFC 3062 LDAP Password Modify Extended Operation February 2001
The integration [RFC2829] of application neutral SASL [RFC2222] services which support simple username/password mechanisms (such as DIGEST-MD5) has introduced non-LDAP DN authentication identity forms and made storage of passwords the responsibility of the SASL service provider.
LDAP update operations are designed to act upon attributes of an entry within the directory. LDAP update operations cannot be used to modify a user’s password when the user is not represented by a DN, does not have a entry, or when that password used by the server is not stored as an attribute of an entry. An alternative mechanism is needed.
This document describes an LDAP Extended Operation intended to allow directory clients to update user passwords. The user may or may not be associated with a directory entry. The user may or may not be represented as an LDAP DN. The user’s password may or may not be stored in the directory.
The operation SHOULD NOT be used without adequate security protection as the o...