Reload Attribute Info
Compare this Object with another
Add New Attribute
Add Attribute Element to an Array
Remove Attribute
Show only Attributes that have Values
Show Friendly Object Names
Show Distinguished Name in Novell Notation
Show Hex Output for Hex Values
Show Multivalued Attributes
Set Attribute List Filter
Show Attribute Names and Values
This option is only available if you selected one single account object in the object list in the LEX main window. Objects with the following structural object classes are regarded as account objects:
The option is disabled for eDirectory environments, LEX cannot reset eDirectory user passwords (yet). If you see the Edit - Set Password option only disabled and grey, then this could be also because your focus lays on the attribute list panel or you didn't selected a single object in the object list.
If you use this option, the Reset Password dialog is shown so that you can set the account password for the regarding Directory objects. Naturally, though, you cannot change any passwords if you do not have the appropriate permission to do that.
This is the Reset Password dialog if you are connected to an Active Directory server (AD Domain Controller, ADAM server or AD LDS server):
The password set by writing the unicodePwd attribute. In this operation the password is converted to a Base64 encoded unicode string internally befor LEX writes the value to the directory. Please note that you need the AD Control Access permission 'Reset Password' for this.
The unicodePwd attribute can be written only if you are connected through a SSL encrypted LDAP connection. This restriction can be abolished only in ADAM / AD LDS environments if you are changing the dsHeuristics value in the configuration partition. You can also use the dsHeuristics to enable password changing by accessing the userPassword attribute, in this case you don't have to Base64 encode the pasword value first.
This is the Reset Password dialog if you are connected to any other LDAP server than an Active Directory server (for example, if you are connected to an OpenLDAP server):
Passwords should never be stored in an attribute in clear text - in fact, most generic LDAP directories store an hash value of the password - in other words, a kind of encryption. Normally it should prevent any user who can read this value to re-calculate the original password, but it allows to check a password entered by the user in an authentication process.
Depending on the directory server, several different hash algorithms could be used. According to RFC 2307, the syntax of the hash value has to be '{HashAlgorithm}Hashvalue'. Only a few hash algorithms are used without indicating the algorithm name in curly brackets.
The LEX Reset Password dialog can calculate hash values for you, if you want to set a new password for an object. you just have to enter the password in the New password text box. When you re-enter the same password in the Confirm password text box, the regarding hash value is calculated and shown in the Password value box.
Please note that not all of these algorithms are supported by all LDAP servers. If you use an algorithm which indicated in the hash value, you can use the In Uppercase option to choose how the algorithm label should be inserted. Oddly enough, some LDAP server enforces the label to be upper case, although the RFC document specify this to be in lower case.
You can read more about salted password hash algorithms in the manual topic Editor for Password Attributes.
