title: Java with LDAP: change users password without administrative rights?
body: <p>Inside a Java Web Project, I'm trying to let users change their own LDAP password (wether it is because it expired or because they simply want to). These users do NOT have administrative rights.</p>
  
  <p>I've been able to do a search to find one of the users, but I'm not able to change it's password.
  Is there any way to let users change their own LDAP password without giving them Administrative rights?</p>
  
  <p>Here is the code I have right now:</p>
  
  <pre><code>        DirContext context;
          context = getInitialContext(username, password, ldapPath, ldapDomain);
  
          // Set up search constraints
          SearchControls cons = new SearchControls();
          String[] attrIDs = { "cn" };
          cons.setReturningAttributes(attrIDs);
          cons.setSearchScope(SearchControls.ONELEVEL_SCOPE);
  
          String USERS_OU = ldapPath.split("/")[ldapPath.split("/").length-1];
          NamingEnumeration&lt;?&gt; results = context.search(USERS_OU, "sAMAccountName=[name]", cons); //I'm searching the sAMA for testing purposes
  
          while (results.hasMore()) {
              SearchResult result = (SearchResult) results.next();
              Attributes attrs = result.getAttributes();
              String userCN = attrs.get("cn").get(0).toString();
  
              // Here I'm able to retrieve a user's CN
  
              ModificationItem[] mods = new ModificationItem[2];
              Attribute mod0 = new BasicAttribute("userPassword", password);
              Attribute mod1 = new BasicAttribute("userPassword", newPass);
              mods[0] = new ModificationItem(DirContext.REMOVE_ATTRIBUTE, mod0);
              mods[1] = new ModificationItem(DirContext.ADD_ATTRIBUTE, mod1);
  
              context.modifyAttributes([CN + ldapPath], mods );
          }
  </code></pre>
  
  <p>Thanks in advance!</p>
  
  <p>UPDATE: I've checked the question rkosegi marked, but I think the solution doesn't apply here, since the OP was trying to change to 'unicodePwd', not 'userPassword', and 'unicodePwd' requires the connection to be ldaps.</p>
  
  <p>There's one thing I found out on my research, and it's that on .NET there's a special operation, the DirectoryEntry.Invoke method, being one of it's possible operations 'ChangePassword', which doesn't require admin permissions. Maybe there's something like that on Java?</p>