Is there an example of setting an Active Directory attribute from F5 iRule or Access Policy?

Hi, i have never seen that we could modify AD attributes from APM policy agent.

You could eventually change it with an lDAP request using irule sideband connection if the AD allows such modification. This will need some work to create the ldap request i believe:

https://devcentral.f5.com/wiki/iRules.SIDEBAND.ashx

Does this help https://devcentral.f5.com/questions/implement-apm-change-password-with-115x ?

Does this help https://devcentral.f5.com/questions/implement-apm-change-password-with-115x ?

You may be able to play with the logon page and some customization to set variables to trigger the password change, for example if you set so values in logon.inc :

$challenge = 1;

$errorcode = 5023;

$GLOBALS["set_new_password"] = 1;

this is triggering automatically the password change, but i won't recommand it as it is intrusive, and may interfere with APM logon page post processing.

11.5 password change feature allows you to setup a check box in the logon page or before in the vpe with a variable assign (session.logon.last.change_password 1) to allows user to change their password.

But your use case would be more to allow all user to change their password (without the first logon prompt) as they currently don't know it ? is that correct ?

This one went quiet, but now we want a solution. Move to 11.6.

May be there are other routes to a solution, but I think it makes sense to try and do this in the style of Arnaud's first answer - e.g. using a regular APM component, since the password change will fail sometimes, and we would want to handle those errors in the same style as when conducting a normal login.

heading the same route here: forgotten password => logon page with userid only => AD Query => Get user email => OTP Generate => Mail => OTP Verify => Reset Password with random value and set User Must Change Password at next logon => Email new new password to user email fetched from AD (same used in OTP step). Missing Step = Reset Password with random value and set User Must Change Password at next logon

heading the same route here: forgotten password => logon page with userid only => AD Query => Get user email => OTP Generate => Mail => OTP Verify => Reset Password with random value and set User Must Change Password at next logon => Email new new password to user email fetched from AD (same used in OTP step). Missing Step = Reset Password with random value and set User Must Change Password at next logon