Currently I have developed a Java WebApplication to offer the ability to change AD-controlled passwords. The WebApplication uses LDAP access to do this. The users need to authenticate and then their password is changed bei a "LdapContext.modifyAttributes()"-method.

Now I experienced that this does not work for users with an initial password. Initial password means the flag "pwdLastSet" is set to require password change by next logon. 

This is, how it works now.

```
prop.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory");
prop.put(Context.PROVIDER_URL, "ldaps://my.active.directory.com:636");
prop.put(Context.SECURITY_AUTHENTICATION, "simple");
prop.put(Context.SECURITY_PROTOCOL,"ADSecurityProtocol");
prop.put(Context.SECURITY_PRINCIPAL,this.userid);
prop.put(Context.SECURITY_CREDENTIALS,password);
ldapContext = new InitialLdapContext(prop, null); 

<...snip...>

ModificationItem[] mods = new ModificationItem[2];
String oldQuotedPassword = "\"" + oldPassword + "\"";
byte[] oldUnicodePassword = oldQuotedPassword.getBytes("UTF-16LE");
String newQuotedPassword = "\"" + newPassword1 + "\"";
byte[] newUnicodePassword = newQuotedPassword.getBytes("UTF-16LE");

mods[0] = new ModificationItem(DirContext.REMOVE_ATTRIBUTE,
new BasicAttribute("unicodePwd", oldUnicodePassword));
mods[1] = new ModificationItem(DirContext.ADD_ATTRIBUTE,
new BasicAttribute("unicodePwd", newUnicodePassword));
ldapContext.modifyAttributes(userDN, mods);

```

I'm looking for an idea how to enable users to change their password especially when they are required to do so. I found some hints that Kerberos might be required - but I almost don't know anything about Kerberos.

Any help is appreciated.

Ulrich