LDAP Password Modify Extended Operation
RFC 3062

Document Type RFC - Proposed Standard (February 2001; Errata)
Author Kurt Zeilenga 
Last updated 2020-01-21
Stream Legacy
Formats plain text html pdf htmlized with errata bibtex
Stream Legacy state (None)
Consensus Boilerplate Unknown
RFC Editor Note (None)
IESG IESG state RFC 3062 (Proposed Standard)
Telechat date
Responsible AD (None)
Send notices to (None)
Network Working Group                                        K. Zeilenga
Request for Comments: 3062                           OpenLDAP Foundation
Category: Standards Track                                  February 2001

                LDAP Password Modify Extended Operation

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2001).  All Rights Reserved.


   The integration of the Lightweight Directory Access Protocol (LDAP)
   and external authentication services has introduced non-DN
   authentication identities and allowed for non-directory storage of
   passwords.  As such, mechanisms which update the directory (e.g.,
   Modify) cannot be used to change a user's password.  This document
   describes an LDAP extended operation to allow modification of user
   passwords which is not dependent upon the form of the authentication
   identity nor the password storage mechanism used.

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", and "MAY" in this document are
   to be interpreted as described in RFC 2119.

1.  Background and Intent of Use

   Lightweight Directory Access Protocol (LDAP) [RFC2251] is designed to
   support an number of authentication mechanisms including simple user
   name/password pairs.  Traditionally, LDAP users where identified by
   the Distinguished Name [RFC2253] of a directory entry and this entry
   contained a userPassword [RFC2256] attribute containing one or more

   The protocol does not mandate that passwords associated with a user
   be stored in the directory server.  The server may use any attribute
   suitable for password storage (e.g., userPassword), or use non-
   directory storage.

Zeilenga                    Standards Track                     [Page 1]
RFC 3062        LDAP Password Modify Extended Operation    February 2001

   The integration [RFC2829] of application neutral SASL [RFC2222]
   services which support simple username/password mechanisms (such as
   DIGEST-MD5) has introduced non-LDAP DN authentication identity forms
   and made storage of passwords the responsibility of the SASL service

   LDAP update operations are designed to act upon attributes of an
   entry within the directory.  LDAP update operations cannot be used to
   modify a user's password when the user is not represented by a DN,
   does not have a entry, or when that password used by the server is
   not stored as an attribute of an entry.  An alternative mechanism is

   This document describes an LDAP Extended Operation intended to allow
   directory clients to update user passwords.  The user may or may not
   be associated with a directory entry.  The user may or may not be
   represented as an LDAP DN.  The user's password may or may not be
   stored in the directory.

   The operation SHOULD NOT be used without adequate security protection
   as the operation affords no privacy or integrity protect itself.
   This operation SHALL NOT be used anonymously.

2.  Password Modify Request and Response

   The Password Modify operation is an LDAPv3 Extended Operation
   [RFC2251, Section 4.12] and is identified by the OBJECT IDENTIFIER
   passwdModifyOID.  This section details the syntax of the protocol
   request and response.

   passwdModifyOID OBJECT IDENTIFIER ::=

   PasswdModifyRequestValue ::= SEQUENCE {
     userIdentity    [0]  OCTET STRING OPTIONAL
     oldPasswd       [1]  OCTET STRING OPTIONAL
     newPasswd       [2]  OCTET STRING OPTIONAL }

   PasswdModifyResponseValue ::= SEQUENCE {
     genPasswd       [0]     OCTET STRING OPTIONAL }

2.1.  Password Modify Request

   A Password Modify request is an ExtendedRequest with the requestName
   field containing passwdModifyOID OID and optionally provides a
   requestValue field.  If the requestValue field is provided, it SHALL
   contain a PasswdModifyRequestValue with one or more fields present.

Zeilenga                    Standards Track                     [Page 2]
RFC 3062        LDAP Password Modify Extended Operation    February 2001

   The userIdentity field, if present, SHALL contain an octet string
   representation of the user associated with the request.  This string
   may or may not be an LDAPDN [RFC2253].  If no userIdentity field is
   present, the request acts up upon the password of the user currently
   associated with the LDAP session.

   The oldPasswd field, if present, SHALL contain the user's current

   The newPasswd field, if present, SHALL contain the desired password
Show full document text