When new users are initially set up, their web access password is set to a default, but the force password change flag is also checked, so that the first time they log in, they are forced to change their password.
We are finding that after the new user has changed their password, both the new password and the default password still work. Using a password that was not previously entered however does not allow them access, as it should.
Is this a bug in Domino, that the old password still works, or is it a setting to be changed on the server ?
Thanks, Tom.
Subject: After forcing web password change, both new and old password still work
For info, this cache can be changed using the notes.ini parameter “http_pwd_change_cache_hours=x” - where x = number of hours
Subject: RE: After forcing web password change, both new and old password still work
Hi,I do have the same problem with some users.
Do I have to add (for example) to my notes.ini (in DOMINO directory) this line?
http_pwd_change_cache_hours=1
and then the problem will be automatically fixed after 1 hour?
Thank you.
Subject: After forcing web password change, both new and old password still work
I think this is by design… both passwords will work for 48h then after 48h default password will expire
Subject: After forcing web password change, both new and old password still work
From what I understand, this is a feature. The server caches the internet password(s) for a given amount in order to allow the Active Directory and Notes domain logons to synchronize. If you have Single Sign On enabled, then password changes may not be enforced until the next Windows logon.
Also it depends on the policy you have set up. Whether or not the internet password will change when the notes client password changes.
Check your password or custom password policy to see what options are in effect.