Our content manager (2011 SP1) uses LDAP directory service for authentication. There are tridion editors who would use ONLY Tridion and nothing else. New users of this kind will not be able to login to the Tridion CME since the AD will be set to "Change password on first login" and Tridion would still show the basic authentication grey box rather than a prompt for a new password. Can we extend Tridion.Security and built a authentication mechanism for change and reset password? If Tridion just leverages the IIS Basic Authentication, then a custom .NET forms authentication should be built to meet the requirements. If that is the case, I will post the question in a Microsoft forum.

  • 1
    Can you explain what you mean when you say "the AD will be set to 'Change password on first login'"? Surely that is an option that you can control in Active Directory. Commented Jul 25, 2013 at 20:32
  • You could probably integrate with a 3rd party log-on provider, for which Tridion provides an SSO connection. But it is probably simpler sticking to your existing setup and simply modify your LDAP-backend (e.g. Active Directory) to not require a password change (as Dom suggested). Commented Jul 27, 2013 at 12:11

1 Answer 1


Tridion will make sure the person is authenticated from the AD, but that's it. Tridion as an organization has a best-of-breed approach and tries not to do things that others have done well, including authorization solutions. They sit on top and integrate with other well defined and correct solutions.

I would suggest to place a page on your extranet login success page that allows new users (ie. Tridion editors) to update their password. Making it a 'Tridion problem' is only making the solution more complex and opaque.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.