我有一个Web应用程序服务器，它调用了
System.DirectoryServices.AccountManagement.AuthenticablePrincipal对象上的
ChangePassword方法。当前密码和新密码字段被正确填充并由经过身份验证的用户发送到
ChangePassword方法中。
在我的情况下：
- 我没有跨域；我的Web应用程序服务器在同一域中。
- 我们有两个域控制器；都在本地网络上。
- Web服务器正在运行Windows Server 2012 R2；我不确定域控制器的操作系统。
我的代码如下:
public bool ChangePassword(string username, string oldPassword, string newPassword, out ActiveDirectoryMembership.LogonError changePasswordLogonError)
{
try
{
using (var context = new PrincipalContext(ContextType.Domain, DomainServer, _ldapUsername, _ldapPassword))
{
using (var user = UserPrincipal.FindByIdentity(context, IdentityType.SamAccountName, username))
{
user.ChangePassword(oldPassword, newPassword);
changePasswordLogonError = ActiveDirectoryMembership.LogonError.LogonSuccessful;
return true;
}
}
}
catch (PrincipalOperationException pex)
{
if ((ActiveDirectoryMembership.LogonError)(pex.ErrorCode) == ActiveDirectoryMembership.LogonError.AccountLockedOut)
{
changePasswordLogonError = ActiveDirectoryMembership.LogonError.AccountLockedOut;
return false;
}
else
throw;
}
catch (PasswordException pwdEx)
{
Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.ExceptionPolicy.HandleException(pwdEx, Policies.WARNING_EXCEPTION_POLICY_NAME);
//Look at the error message and attempt to parse out the HRESULT and map it to our LogonError enum
//A complete list of Network Management Error codes is available here: http://msdn.microsoft.com/en-us/library/windows/desktop/aa370674(v=vs.85).aspx
//The HRESULT is a hex value which will need to be converted to an int in order to be matched against the list of Error code values
if (pwdEx.Message.Contains("HRESULT: 0x80070056"))
changePasswordLogonError = ActiveDirectoryMembership.LogonError.LogonFailure;
else if (pwdEx.Message.Contains("HRESULT: 0x800708C5"))
changePasswordLogonError = ActiveDirectoryMembership.LogonError.PasswordDoesNotMeetComplexityRequirements;
else
throw;
return false;
}
catch (Exception)
{
throw;
}
}
我的应用服务器已安装了Microsoft Security Bulletin MS16-014中提到的所有补丁。但是，当用户尝试更改密码时，将抛出以下异常，但密码仍然会成功更改。此外，用户可以通过应用程序使用旧密码和新密码进行登录！
Timestamp: 2016-03-08 12:39:55.033
Message: HandlingInstanceID: cd253adb-1e51-489a-8cf5-870568fb26ff
An exception of type 'System.DirectoryServices.AccountManagement.PasswordException' occurred and was caught.
------------------------------------------------------------------------------------------------------------
03/08/2016 12:39:54
Type : System.DirectoryServices.AccountManagement.PasswordException, System.DirectoryServices.AccountManagement, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
Message : The specified network password is not correct. (Exception from HRESULT: 0x80070056)
Source : System.DirectoryServices.AccountManagement
Help link :
Data : System.Collections.ListDictionaryInternal
TargetSite : Void ChangePassword(System.DirectoryServices.DirectoryEntry, System.String, System.String)
HResult : -2146233087
Stack Trace : at System.DirectoryServices.AccountManagement.SDSUtils.ChangePassword(DirectoryEntry de, String oldPassword, String newPassword)
at System.DirectoryServices.AccountManagement.ADStoreCtx.ChangePassword(AuthenticablePrincipal p, String oldPassword, String newPassword)
at System.DirectoryServices.AccountManagement.PasswordInfo.ChangePassword(String oldPassword, String newPassword)
at System.DirectoryServices.AccountManagement.AuthenticablePrincipal.ChangePassword(String oldPassword, String newPassword)
at MyApplication.Web.UI.Infrastructure.ActiveDirectoryMembershipProvider.ChangePassword(String username, String oldPassword, String newPassword, LogonError& changePasswordLogonError)
Additional Info:
MachineName : SOME-SERVER
TimeStamp : 3/8/2016 5:39:55 PM
FullName : Microsoft.Practices.EnterpriseLibrary.ExceptionHandling, Version=3.1.0.0, Culture=neutral, PublicKeyToken=null
AppDomainName : /LM/W3SVC/1/ROOT-3-131019323428219091
ThreadIdentity :
WindowsIdentity : DOMAIN\App-Pool-Username
Inner Exception
---------------
Type : System.Runtime.InteropServices.COMException, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
Message : The specified network password is not correct. (Exception from HRESULT: 0x80070056)
Source :
Help link :
ErrorCode : -2147024810
Data : System.Collections.ListDictionaryInternal
TargetSite :
HResult : -2147024810
Stack Trace : The stack trace is unavailable.
我们从应用服务器中移除了KB3126041，一切都很好！
UserPrincipal.ChangePassword()仍然会抛出此异常。 - Ellesedil