LDAP Change Password OpenLDAP

[J Ball]

It seems that Spring Security is caching the login credentials, and I'm not sure how to prevent it. Here are the steps I take:

1. login with user/pass
2. change password to pass1
3. logout
4. login with user/pass (this shouldn't work but still does)
5. logout
6. logout with user/pass1 (this should work and does)

Notice that now the user can login with the old and new password. If I redeploy my application, then it is corrected - the old password doesn't work and the new one does.

I am using standalone ApacheDS for LDAP and Tomcat for my application.

[Luke Taylor]

What version are you using? Do you have a cache configured?

[J Ball]

Sorry, thought I had it here, but I am using Spring Security 2.0.4. I am new to OpenLDAP but have setup no cache for the database. Is there a cache on the Spring Security side? Is there a way to flush the cache after I make the following call. I can see that LDAP contains the new password.

ModificationItem[] modificationItemArray = new ModificationItem[2];
String newpassword = null;
try {
newpassword = getSHA1(newpw);
} catch (NoSuchAlgorithmException e1) {
// TODO Auto-generated catch block
e1.printStackTrace();
} catch (UnsupportedEncodingException e1) {
// TODO Auto-generated catch block
e1.printStackTrace();
}
Attribute userPasswordAttribute = new BasicAttribute(LDAP_USER_PASSWORD, newpassword);
ModificationItem newPassword = new ModificationItem(DirContext.REPLACE_ATTRIBUTE, userPasswordAttribute);
modificationItemArray[0] = newPassword;

Attribute userPasswordChangedAttribute = new BasicAttribute(LDAP_PASSWORD_CHANGE_DATE, format.format(convertToUtc(null).getTime()) + "Z");
ModificationItem newPasswordChanged = new ModificationItem(DirContext.REPLACE_ATTRIBUTE, userPasswordChangedAttribute);
modificationItemArray[1] = newPasswordChanged;
ldapTemplate.modifyAttributes(getDN(), modificationItemArray);

[Luke Taylor]

I would check debug your application (or check the logs) and check if the bind is being executed to authenticate against the directory. If so, and the password has changed, then it should fail. There is no caching option in 2.0.4 with bind authentication.

[irishfan99ko]

I am having the exact same problem as described above using 2.0.4 and OpenDS. Were you able to track down what the problem was?

[J Ball]

Sorry, but I was unable to fix this problem and have since moved on to another project.

[irishfan99ko]

Thanks for getting back to me.