Jabber users unable to change their password

[collinks2]

Hello GuysI am running cucm 11.5,imp 11.5 and other uc applications. I have ldap successfully set up.i have cisco jabber version 12.1.

In the ldap,if i enable "users must change their passwords on the next log on " the users will not be able to log in.if disable it ,users will log in. "The change password" option is greyed out in the jabber app.

1. How can i fix this issue so that users can change their own password?

2. In the jabber-xml config file,what is the url to put for the option "forgot password"

Thanks in anticipation!

Collins

[Jaime Valencia]

The option to change the password directly from Jabber is ONLY for Webex.

If you use LDAP, they need to use the built-in options the company might provide to change their LDAP password, a dedicated web-page, ctrl+alt+supr and then then change password, etc.

[collinks2]

Hello Mr Valencia, Thank you for your quick response. Let me also use this medium commend you for your useful videos on Cisco collaboration applications.

Could you be a bit more elaborate? I am the one managing the company's ldap as well.I do not understand what you mean by built in options and the kind of webpage that will provide link for users to change their password.

I have exchange server 2016 which i use in lab environment. If enable the option "users must Change password on the next logon " exchange users can change their password but jabber users cant even log in,let alone changing their own password

Thanks

[Jaime Valencia]

What you're asking is beyond the scope of Cisco, that depends on your LDAP, and what options it offers for you to provide a way for users to change their passwords.

You can build a web-page in which users could change their LDAP password, or any other alternative you like.

If you use Windows, you can use the change password option directly from Windows. Or have users use Exchange to then update LDAP and then use Jabber.

What you're seeing is the expected behavior as CUCM uses simple bind for authentication.

[collinks2]

Ok. I have gotten some guides on google on how to build a webpage for ldap
users to change their password.see links below
https://github.com/ltb-project/self-service-password/blob/master/README.md

https://github.com/unosquare/passcore


I will still try the option of allowing users to use exchange and update
their password.

[collinks2]

Hello,
I have be able to get a webpage that allows users to change their password. The exchange option is working as well.
However, if a user changes his password ,the users wont log in unless i performe ldap sync in cucm.is there no way to make the users new password to sync with the cucm without involving the administrator.

[Jaime Valencia]

Passwords are NEVER synced to CUCM, a simple bind is used for authentication.

[collinks2]

I do not understand .what can i do in this situation? Why can't they login
until i perform the ldap sync in cucm .if the users change password, they
are still log in until i perform the ldap sync in cucm

[Pavel Herc]

Hi  try to reset jabber after the Ldap password is set. 

It can be that it is stored in the folder and it is not refreshed automatically?

In Mobile jabber ( APple) it is like this if I remember  correctly. ( I assume users log to the jabber when computer starts)

[collinks2]

Hi,
I did that too but i still log in with both the old and new password.(i
will still try it again and see what happens). Immediately, i perform the
cucm ldap sync ,the user will not be able to log in again with the old
password. Infact ,the user will get an error notification in jabber that
the user credentials are valid.
I have written to Microsoft to see if there is LDAP password sync that
update the password change in another application since cucm ldap binds to
ldap authentication.

[Pavel Herc]

and how often it is being synced during the day  ( each 4 hours etc.)?

As far as I know the AD password change should be updated veryfast ( almost immediatelly) i think in the AD.

LDAP is then only hcecking if the pwd in the jabber is the same as the pwd in the AD.

[collinks2]

Exactly what i thought but it is not working.however ,the password change
reflects in the both the exchange server and jabber.For jabber ,the old
password still reflect unit i perform ldap sync in the cucm.
I was hoping to see invalid credentials once there is a password update on
the AD. You can check it in your lab