Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

0

Hi

I’m working with forgot password link on custom login page having active directory membership(LDAP)

For which I need to set web.config of webapplication in sharepoint

For example

    <add name="AspNetActiveDirectoryMembershipProvider" 

      type="System.Web.Security.ActiveDirectoryMembershipProvider, 

      System.Web, Version=2.0.3600, Culture=neutral, 

      PublicKeyToken=b03f5f7f11d50a3a"

      connectionUsername="UserWithResetPasswordRights"

      connectionPassword="PasswordForUser"

      enablePasswordReset="true"

      requiresQuestionAndAnswer="true"

      attributeMapPasswordQuestion="PasswordQuestionADAttribute"

      attributeMapPasswordAnswer="PasswordAnswerADAttribute"

      attributeMapFailedPasswordAnswerCount="AnswerCountADAttribute"

      attributeMapFailedPasswordAnswerTime="AnswerTimeADAttribute"

      attributeMapFailedPasswordAnswerLockoutTime="LockOutTimeADAttribute" />

  </providers>

Here I have set enablePasswordReset="true", but was not working out because I found information as below:

You can only set the EnablePasswordReset property true when the following membership element settings have been made. • requiresQuestionAndAnswer must be true. • The Active Directory schema must be modified to contain attributes for storing the password question and answer, as well as the three tracking fields for password-answer change attempts. • attributeMapPasswordQuestion, attributeMapPasswordAnswer, attributeMapFailedPasswordAnswerCount, attributeMapFailedPasswordAnswerTime, and attributeMapFailedPasswordAnswerLockoutTime must be mapped to attributes in the Active Directory schema.

If the above criteria are not met, a ProviderException is thrown at initialization. I have error means I have lack of this parameter values. So here my question arise , by modifying Active Directory schema, from a security point of view is it problematic?We guess Sharepoint App Pool account need to have either domain admin or at least password reset permissions for all users to use intranet solution, and this is something represents a potially large security hole that could be used to exploit access to active directory.

Is there any other option to handle this situation ??

I might be wrong in somewhere...

Any help would be appreciated...

Thanks :)

share|improve this question
add comment

1 Answer 1

Before making all these changes to AD, i'd probably look to see if you can find a different membership provider without these requirements, or purchase a forgot password web part that functions directly against AD and doesn't have these requirements.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.