ChangeUserPassword (OP-10)

Request and response

Part	Type	Description
inUserId	String	The SamAccountName of the account whose password is reset.
inNewPassword	String	The new password, carried as a plaintext SOAP string parameter (SEC-06 — see Authentication and authorization). Never reproduce example values in documentation; use <value> placeholders only.

Part	Type	Description
<return>	ADServiceResponse	Response is Success, UserDoesNotExist, or Failure. Message carries the caught exception text on a Failure, otherwise empty.

WebMethod attributes

<WebMethod()> — bare, no arguments supplied.

Steps

1. CheckAccess(); on denial return AccessDenied() (BR-01).
2. Initialize the response sentinel to Success.
3. Open Try; call the private helper H6 ChangePassword(inUserId, inNewPassword) and assign its EResponse result to Response (BR-25).
4. H6 selects the external domain via H1, resolves the user with UserPrincipal.FindByIdentity directly (returning UserDoesNotExist when Nothing), and otherwise invokes SetPassword on the underlying DirectoryEntry (late-bound) followed by CommitChanges(). H6 itself contains no Catch — every failure inside it propagates to this operation's own Try.
5. Catch ex As Exception → set Response = Failure, Message = ex.Message (BR-26).
6. Return the response sentinel.

Process flow

flowchart TD
    A["Call ChangeUserPassword"] --> B{"CheckAccess<br>HasAccess?"}
    B -->|"No"| C["Return AccessDenied"]
    B -->|"Yes"| D["Try: call H6 ChangePassword"]
    D --> E["H6: FindByIdentity<br>external domain"]
    E -->|"Nothing"| F["H6 returns UserDoesNotExist"]
    E -->|"Found"| G["H6: SetPassword + CommitChanges"]
    F --> H["Assign Response<br>from H6 result"]
    G --> H
    H --> I["Return response"]
    D -.->|"Any exception<br>from H6 or context"| J["Catch: Set Failure + ex.Message"]
    J --> I

Shared state effects

None — this operation touches no process-wide state; all locals are per-request.

Error handling

The operation never surfaces a framework SOAP fault: a rejected password (policy, history, complexity) or any other directory failure inside H6 is caught here and flattened into Response = Failure with the raw .NET exception text in Message. Compare with ChangeUserPasswordOrGetException, which invokes the same helper with no exception handling. See Faults for the service-wide fault model.

Authorization

Gated by BR-01: the caller must pass the IP allow-list check enforced by CheckAccess. See Authentication and authorization.

Related documentation

• Service index
• Overview
• Architecture
• Activation and hosting
• Operations
• Operations and processes
• Business rules
• Authentication and authorization
• Configuration
• Dependencies
• Faults
• Operational runbook
• Tech debt

Sources

• src\ADUserServices\clsADUserServices.asmx.vb (lines 471-491, helper ChangePassword lines 503-524)