Skip to content

Change Active Directory password

ChangePassword resets the AD password for a named user identified by user ID — independent of whatever account m_DirUser currently references — and optionally stamps the account's Comment attribute with the identity of who made the change.

Field Value
Operation ID OP-SU-06
Trigger Caller calls clsSystemUser.ChangePassword(inUserId, inNewPwd, [inUpdatedBy])
Inputs inUserId target user ID; inNewPwd new password value; optional inUpdatedBy updater identity
Outputs Boolean result; updated AD password and, when supplied, updated Comment attribute
Primary components clsSystemUser.ChangePassword(...)
Entry point Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb

Steps

  1. Resolve the target user. ChangePassword calls m_DirServer.GetUser(inUserId) to locate the account, independent of the object's own m_DirUser context.
  2. Handle a failed lookup. If the user cannot be found, isValid is set to False and no password change is attempted.
  3. Set the new password. If the user is found, a Try block invokes thisUser.m_DirEntry.Invoke("SetPassword", inNewPwd).
  4. Record the updater. If inUpdatedBy is not empty, thisUser.Comment is set to that value in the same Try block.
  5. Handle a failed password set. If SetPassword (or the Comment assignment) raises an exception, it is caught and re-thrown as ApplicationException("Unable to set password.", ex) — the caller receives a wrapped exception rather than a False return for this failure path.
  6. Commit unconditionally. Regardless of whether the Try block succeeded or threw, the Finally block calls thisUser.m_DirEntry.CommitChanges().
  7. Return the outcome. The method returns isValid. Note that isValid is only ever explicitly set to False (step 2, when the user is not found); it is never set to True on the success path, so a successful password reset also returns False unless the caller lookup failed.*

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([Caller calls ChangePassword]) --> Lookup[m_DirServer.GetUser inUserId]
    Lookup --> Found{User found?}
    Found -->|No| Fail([isValid = False; return False])
    Found -->|Yes| SetPwd[Invoke SetPassword with inNewPwd]
    SetPwd --> UpdatedBy{inUpdatedBy supplied?}
    UpdatedBy -->|Yes| SetComment[Set Comment to inUpdatedBy]
    UpdatedBy -->|No| Commit
    SetComment --> Commit[Finally: CommitChanges]
    SetPwd -.exception.-> Throw[Throw ApplicationException]
    Commit --> Return([Return isValid - always False on this path*])

Failure and edge-case behavior

  • ChangePassword returns False for both a "user not found" outcome and a successful password reset, because the isValid variable is never assigned True anywhere in the method; callers cannot distinguish success from a not-found condition using the return value alone.*
  • A failure during SetPassword throws an ApplicationException rather than returning False, so callers must handle both a thrown exception and a False return to fully cover this method's failure modes.
  • CommitChanges() runs in the Finally block even when SetPassword threw, so a partially-applied Comment change (if it executed before the exception) may still be committed.*
  • The method operates on any user resolvable by inUserId, not just the object's currently loaded m_DirUser — it does not require Switch active user context to have been called first.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

Sources

  • Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb