Forgot password in sharepoint with activedirectory membership?

Question

0

Hi

I’m working with forgot password link on custom login page having active directory membership(LDAP)

For which I need to set web.config of webapplication in sharepoint

For example

    <add name="AspNetActiveDirectoryMembershipProvider" 

      type="System.Web.Security.ActiveDirectoryMembershipProvider, 

      System.Web, Version=2.0.3600, Culture=neutral, 

      PublicKeyToken=b03f5f7f11d50a3a"

      connectionUsername="UserWithResetPasswordRights"

      connectionPassword="PasswordForUser"

      enablePasswordReset="true"

      requiresQuestionAndAnswer="true"

      attributeMapPasswordQuestion="PasswordQuestionADAttribute"

      attributeMapPasswordAnswer="PasswordAnswerADAttribute"

      attributeMapFailedPasswordAnswerCount="AnswerCountADAttribute"

      attributeMapFailedPasswordAnswerTime="AnswerTimeADAttribute"

      attributeMapFailedPasswordAnswerLockoutTime="LockOutTimeADAttribute" />

  </providers>

Here I have set enablePasswordReset="true", but was not working out because I found information as below:

You can only set the EnablePasswordReset property true when the following membership element settings have been made. • requiresQuestionAndAnswer must be true. • The Active Directory schema must be modified to contain attributes for storing the password question and answer, as well as the three tracking fields for password-answer change attempts. • attributeMapPasswordQuestion, attributeMapPasswordAnswer, attributeMapFailedPasswordAnswerCount, attributeMapFailedPasswordAnswerTime, and attributeMapFailedPasswordAnswerLockoutTime must be mapped to attributes in the Active Directory schema.

If the above criteria are not met, a ProviderException is thrown at initialization. I have error means I have lack of this parameter values. So here my question arise , by modifying Active Directory schema, from a security point of view is it problematic?We guess Sharepoint App Pool account need to have either domain admin or at least password reset permissions for all users to use intranet solution, and this is something represents a potially large security hole that could be used to exploit access to active directory.

Is there any other option to handle this situation ??

I might be wrong in somewhere...

Any help would be appreciated...

Thanks :)

Answer 1

Before making all these changes to AD, i'd probably look to see if you can find a different membership provider without these requirements, or purchase a forgot password web part that functions directly against AD and doesn't have these requirements.