2

I am referring to an article:- Change the Active Directory User Password Through SharePoint

My requirement is: Change the Active Directory User Password Through SharePoint.

Code:-

// Claims-based authentication
// - Decode the claims-based authentication name
string username = "";
SPClaimProviderManager mgr = SPClaimProviderManager.Local;

if (mgr != null)
{
    username = mgr.DecodeClaim(SPContext.Current.Web.CurrentUser.LoginName).Value;
}

// Get the domain context
using (PrincipalContext ctx = new PrincipalContext(ContextType.Domain))
{
    UserPrincipal user = new UserPrincipal(ctx);
    user = UserPrincipal.FindByIdentity(ctx, username);
}

user.ChangePassword("OLD_PASSWORD", "NEW_PASSWORD");
user.Save(); 

// Claims-based authentication
// - Decode the claims-based authentication name
string username = "";
SPClaimProviderManager mgr = SPClaimProviderManager.Local;

if (mgr != null)
{
    username = mgr.DecodeClaim(SPContext.Current.Web.CurrentUser.LoginName).Value;
}

// Get the domain context
using (PrincipalContext ctx = new PrincipalContext(ContextType.Domain))
{ 
    if (username != "" && username != null)
    {
        UserPrincipal user = new UserPrincipal(ctx);
        user = UserPrincipal.FindByIdentity(ctx, username);
        //Change the old and new password by your own textbox values
        user.ChangePassword("OLD_PASSWORD", "NEW_PASSWORD");
        user.Save();
    }
}

The article mentions right at the bottom that:-

When you are going to execute this code, you may get the following error: Exception thrown by a target of invocation. To solve this error, you will need to give the application pool account delegate control permissions to change the users password.

My question is:-

1. In SharePoint, since the code on webpart runs under the credentials of the current user, and since he is not using the RWEP in the example above (so the code is not running under apppoolaccount also!), then why does author say that 'you will need to give the application pool account delegate control permissions to change the users password'?

Also this question on stack overflow is answered: what account does code run under in sharepoint 2010 and says that code on webpart runs under credentials of current user.. Then why does the author of article say that give the application pool account delegate control permissions to change the users password?

.2. This article: http://www.ashokraja.me/post/Change-Password-Web-Part-for-SharePoint-2010.aspx makes use of impersonation class, can you tell me under what account is he trying to impersonate? Is it the application pool account? This author is also doing same thing. Why are all trying to run code via apppool account, when we know that code in SharePoint gets executed as current user account?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.