RFC 3062 (rfc3062) - Page 1 of 6

LDAP Password Modify Extended Operation

Alternative Format: Original Text Document
Next >
Network Working Group                                        K. Zeilenga
Request for Comments: 3062                           OpenLDAP Foundation
Category: Standards Track                                  February 2001


                LDAP Password Modify Extended Operation

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2001).  All Rights Reserved.

Abstract

   The integration of the Lightweight Directory Access Protocol (LDAP)
   and external authentication services has introduced non-DN
   authentication identities and allowed for non-directory storage of
   passwords.  As such, mechanisms which update the directory (e.g.,
   Modify) cannot be used to change a user's password.  This document
   describes an LDAP extended operation to allow modification of user
   passwords which is not dependent upon the form of the authentication
   identity nor the password storage mechanism used.

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", and "MAY" in this document are
   to be interpreted as described in RFC 2119.

1.  Background and Intent of Use

   Lightweight Directory Access Protocol (LDAP) [RFC 2251] is designed to
   support an number of authentication mechanisms including simple user
   name/password pairs.  Traditionally, LDAP users where identified by
   the Distinguished Name [RFC 2253] of a directory entry and this entry
   contained a userPassword [RFC 2256] attribute containing one or more
   passwords.

   The protocol does not mandate that passwords associated with a user
   be stored in the directory server.  The server may use any attribute
   suitable for password storage (e.g., userPassword), or use non-
   directory storage.




Zeilenga                    Standards Track
Next >