For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Abdessamad_851's avatar
Abdessamad_851
Icon for Nimbostratus rankNimbostratus
Apr 07, 2015

OWA Advanced Customization Template - Password Change

Dear,

we have a logon page for OWA customized following the advanced customization guide : https://devcentral.f5.com/wiki/APM.APM-Advanced-Customization-Templates.ashx

But when a password is expired, the APM does not prompt for the change password page, and go back to the logon page again. I see in the log the following error "

AD module: change password for 'username' failed: Password change rejected(4)
"

I took a capture and the AD returns the error STATUS_PASSWORD_MUST_CHANGE as expected.

It works fine with the default logon page with the same username and the same AD. we're running version 11.5.1

Could you please advice on what could be missing in the template?

Thanks.

BIG-IP Access Policy Manager (APM)
deployment
security

1 Reply

  • Michael_Jenkins's avatar
    Michael_Jenkins
    Icon for Cirrostratus rankCirrostratus
    Apr 09, 2015

    From looking at the customization template, I would say that the most likely reason you're seeing this type of experience is because the logon.inc page was completely overridden instead of augmented to fit the OWA style.

     

    The original template contains code to build the change password fields dynamically when necessary, but the customization template manually specifies the username/password fields instead of letting the APM build the form within the customized style of an OWA page.

     

    To fix that, you will probably need to get a copy of the original logon.inc (you could create a new logon page and copy it from there), and then go through the code there to figure out how to customize the page in such a way that you let the PHP code generate the page as it needs to but you wrap that in your own customizations.

     

    I'm working on doing this same thing with my own custom table/style on the login page, and it's tedious, but it works.

     

    Hope this helps.