Hi, Keycloak 2.5.0, added MSAD (samba4) as a writeable federation provider, verified that the MSAD account controls mapper is added. When an end-user logs into the keycloak account client (/auth/realms/ourrealm/account) he/she has the option to change his/her password. However, keycloak says: > Could not modify attribute for DN [CN=ted t. test,CN=Users,DC=samba,DC=company,DC=com] Note: I used "ABC-def123_*%#" as a password, so I guess MSAD password policies are not the problem here. Additionally, I was under the impression that I should be able to logon when in MSAD the "user is required to change password on next login", and keycloak would require me to change it. However, in that case I'm just getting an "Invalid username or password". I asked about these things before, but was told to test the new 2.5.0, because the problem could have been solved already. However, I'm trying with 2.5.0, and the behaviour is still there. Is this functionality working for others using MSAD here? (perhaps others with samba4 AD?) Best regards, MJ _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

Ok, after testing some more, it seems things DO work. Unexpectedly for us, for password changes for END-USERS to work, the keycloak AD service account needs "Domain Admins" permissions. We expected the end-user password change to be done logged on *as* the end-user himself, with a a delete and an add operation. No need for Domain Admin access level. This is what microsoft says on that subject: > There are two possible ways to modify the unicodePwd attribute. The > first is similar to a normal "user change password" operation. In > this case, the modify request must contain both a delete and an add > operation. The delete operation must contain the current password > with quotes around it. The add operation must contain the desired new > password with quotes around it. > > The second way to modify this attribute is analogous to an > administrator resetting a password for a user. In order to do this, > the client must bind as a user with sufficient permissions to modify > another user's password. This modify request should contain a single > replace operation with the new desired password surrounded by quotes. > If the client has sufficient permissions, this password become the > new password, regardless of what the old password was. Anyway: the password change works for us (on samba AD) too. Thanks. Best regards, MJ