Change HTTP Password with XPage

Mindwatering Incorporated

Author: Tripp W Black

Created: 12/30/2011 at 08:43 AM

 

Category:
Notes Developer Tips
XPages

Issue:
Have a password field and want to save/update the password hashed in the HTTPPassword field so that the web password is updated for web authentication.

Notes for this scenario:
- Plain password is stored in Edit Box control named Person_PasswordPlain
(This example stores the plain password temporarily in a local "admin" app xwp1. To not use a datasource, do a ViewScoped variable feed works nicely to not save the value.)
- Hashed password is stored in the Person document in the Domino Directory (names.nsf).
(This example stores it in a second app xwp2 which is names.nsf.)

Solution:

1. Select the plain password Edit Box control.
2. Select the Events tab below.
3. Under Select & Change, choose onchange.
4. Under Server Options, choose Partial Update. Click the Select Element button and choose the programmatic name of the hashed field. Click OK.
5. Still Under Server Options, check on Process data without validation.
6a. Still under the Server tab, leave Simple Actions radio button selected, click the Add Action button.
6b. Leave Category set to All. Change Action to Execute Script. Leave Language set to JavaScript (Server Side).
6c. Enter the following script in the script/Condition field. Click OK when done.

var doc:NotesDocument = xwp1.getDocument();
var dt:NotesDateTime = session.createDateTime("Now");
var curpwd = xwp1.getItemValueString('Person_PasswordPlain');

if (curpwd !='') {
var pwdhashed = session.hashPassword(curpwd);
xwp2.setValue('HTTPPassword', pwdhashed);
xwp2.setValue('HTTPPasswordChangeDate', dt);
}

Notes:
If you have the datasource doing a computewithform, then don't hash the password. That seems to double hash it and break the user's login.

Call nDoc.Replaceitemvalue("HTTPPasswordChangeDate", nowNDT)

6d. Clear the temp password field.

7. Save the updated XPage and test the form.


previous page