Our content manager (2011 SP1) uses LDAP directory service for authentication. There are tridion editors who would use ONLY Tridion and nothing else. New users of this kind will not be able to login to the Tridion CME since the AD will be set to "Change password on first login" and Tridion would still show the basic authentication grey box rather than a prompt for a new password. Can we extend Tridion.Security and built a authentication mechanism for change and reset password? If Tridion just leverages the IIS Basic Authentication, then a custom .NET forms authentication should be built to meet the requirements. If that is the case, I will post the question in a Microsoft forum.
-
1Can you explain what you mean when you say "the AD will be set to 'Change password on first login'"? Surely that is an option that you can control in Active Directory.– Dominic CroninCommented Jul 25, 2013 at 20:32
-
You could probably integrate with a 3rd party log-on provider, for which Tridion provides an SSO connection. But it is probably simpler sticking to your existing setup and simply modify your LDAP-backend (e.g. Active Directory) to not require a password change (as Dom suggested).– Frank van PuffelenCommented Jul 27, 2013 at 12:11
1 Answer
Tridion will make sure the person is authenticated from the AD, but that's it. Tridion as an organization has a best-of-breed approach and tries not to do things that others have done well, including authorization solutions. They sit on top and integrate with other well defined and correct solutions.
I would suggest to place a page on your extranet login success page that allows new users (ie. Tridion editors) to update their password. Making it a 'Tridion problem' is only making the solution more complex and opaque.