A while ago I wrote a little web part for my company to use in our hosted environments that allows the logged in user to change their password. I won’t put any of the design up here, just the functional code in the “Change Password” event that connects to AD and changes the password since the IP for this web part is owned by my employer.

So I have to make the assumption if you are reading this, you know how to code a web part in Visual Studio 2010, or at least have access to a developer who can. This is also not the cleanest code I have written, but it works and is stable:

The basics

There are a couple of objects from .Net that I used, but they all reside in the namespace System.DirectoryServices, the assembly has the same name. To make the actual change you have to use a type of reflection from the class System.DirectoryServices.DirectoryEntry. I will explain what happens, but first here is the code:

SPSecurity.RunWithElevatedPrivileges(() =>
{
    SPWeb webContext = SPControl.GetContextWeb(Context);

    string userLogin = webContext.CurrentUser.LoginName;

    int position = userLogin.IndexOf("\\") + 1;
    userLogin = userLogin.Substring(position);

    DirectoryEntry entry = new DirectoryEntry(String.Format("LDAP://{0}", _domain), userLogin, TextBoxCurrentPassword.Text, AuthenticationTypes.Secure);
    DirectorySearcher search = new DirectorySearcher(entry);
    search.Filter = String.Format("(SAMAccountName={0})", userLogin);
    search.SearchScope = SearchScope.Subtree;
    search.CacheResults = false;

    SearchResultCollection results = search.FindAll();

    if (results.Count > 0)
    {
        foreach (SearchResult result in results)
        {
            try
            {
                entry = result.GetDirectoryEntry();
            }
            catch (Exception searchError)
            {
                LabelResults.Text += searchError.Message + "<br/>";
            }
        }

        try
        {
            entry.Invoke("ChangePassword", new object[] { TextBoxCurrentPassword.Text, TextBoxNewPassword.Text });
            entry.CommitChanges();
            LabelResults.ForeColor = Color.Green;
            LabelResults.Text = "Your password has been changed!";
        }
        catch (Exception changeError)
        {
            if (changeError.InnerException != null)
                LabelResults.Text = changeError.InnerException.Message;
            else
                LabelResults.Text = changeError.Message;
        }
    }
    else
        LabelResults.Text = "User not found";
});

 

So what is happening here. The actual AD code is from DirectoryEntry down. This code is setup so that when the web part is used on a page, the administrator can point it to a particular server in the web part settings.

So we first grab the current logged in user details, and use DirectorySearcher to find the user account. The domain to search through is specified in the DirectoryEntry instance. A filter is also applied to ensure that the it only searches for the logged in user.  We also tell the search to only look at the sub-tree of the specified LDAP.

If we found results, we grab the entry, an assumption is made that the search will ever only find one result since we search for a username which is unique in active directory.

Now that we have the active directory entry for the user, we need to invoke the the “ChangePassword” function. It takes the user’s current password and the new password that they want to change it to. Finally, we tell the entry to commit the changes.

Extra Note:

On the web part, the standard route is taken so the user is required to input their current password and the new password twice. So there are checks before the above code to ensure that the two versions of the new password match as well. All the other checks are present in the code above.

Disclaimer:

Please read the disclaimer if you plan on using anything from this article.