Skip to content

ChangeUserPasswordOrGetException (OP-11)

Request and response

Part Type Description
inUserId String The SamAccountName of the account whose password is reset.
inNewPassword String The new password, carried as a plaintext SOAP string parameter (SEC-06 — see Authentication and authorization). Never reproduce example values in documentation; use <value> placeholders only.
Part Type Description
<return> ADServiceResponse Response is Success or UserDoesNotExist on completion. Message is always String.Empty. Any directory or password-policy failure never reaches this return — it escapes as a framework SOAP fault instead.

WebMethod attributes

<WebMethod()> — bare, no arguments supplied.

Steps

  1. CheckAccess(); on denial return AccessDenied() (BR-01).
  2. Call the private helper H6 ChangePassword(inUserId, inNewPassword) with no exception handling (BR-25, BR-26).
  3. H6 selects the external domain via H1, resolves the user with UserPrincipal.FindByIdentity directly (returning UserDoesNotExist when Nothing), and otherwise invokes SetPassword on the underlying DirectoryEntry (late-bound) followed by CommitChanges(). H6 itself contains no Catch.
  4. Return a new ADServiceResponse with Message = String.Empty and Response set to H6's result.

This is the deliberate faulting variant by design: unlike ChangeUserPassword, no Try/Catch exists anywhere in this operation.

Process flow

flowchart TD
    A["Call ChangeUserPasswordOrGetException"] --> B{"CheckAccess<br>HasAccess?"}
    B -->|"No"| C["Return AccessDenied"]
    B -->|"Yes"| D["Call H6 ChangePassword<br>no Try/Catch"]
    D --> E["H6: FindByIdentity<br>external domain"]
    E -->|"Nothing"| F["H6 returns UserDoesNotExist"]
    E -->|"Found"| G["H6: SetPassword + CommitChanges"]
    F --> H["Return ADServiceResponse<br>Message = empty"]
    G --> H
    D -.->|"Any exception<br>from H6 or context"| I["Propagates as<br>framework SOAP fault"]

Shared state effects

None — this operation touches no process-wide state; all locals are per-request.

Error handling

Any directory or password-policy failure inside H6 (or in the underlying context construction) surfaces as a framework SOAP fault carrying the raw .NET exception — there is no operation-level Try/Catch at any point. This operation and ChangeUserPassword are near-duplicates differing only in error strategy (tech debt TD-24 — see Tech debt); the operation name does not make this difference discoverable from the WSDL. On success the caller receives Response = Success with an empty message; when the user is absent the caller receives Response = UserDoesNotExist before any write. See Faults for the service-wide fault model.

Authorization

Gated by BR-01: the caller must pass the IP allow-list check enforced by CheckAccess. See Authentication and authorization.

Sources

  • src\ADUserServices\clsADUserServices.asmx.vb (lines 493-501, helper ChangePassword lines 503-524)