[GUACAMOLE-1296] Add support for LDAP/AD password expiration and reset

• Type: New Feature
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 1.3.0
• Component/s: guacamole-auth-ldap
• Assignee: Unassigned
• Reporter: Gary V
• Created: 23/Feb/21 13:39
• Updated: 20/Jan/22 20:22

Description

Guacamole login fails when a user is required to set a new AD password after first login.

When a user logs in, AD returns code 773, which implies the authorization is correct but a new password must be set immediately in the remote session.

Guacamole login fails.

 

Hint from catalina.out:

Message ID : 1
{{ BindResponse}}
{{ Ldap Result}}
{{ Result code : (INVALID_CREDENTIALS) invalidCredentials}}
{{ Matched Dn : ''}}
{{ Diagnostic message : '80090308: LdapErr: DSID-0C090439, comment: AcceptSecurityContext error, data 773, v4563^@'}}

 

Edit some hours later:

I was able to workaround the problem by setting the password of the users account to the same default password as set in AD. Then the login succeeded, Windows forced the user to change password, and the user was then able to login with the new username/password combo.