LDAPPluginBase.updateCredentials changes the users password in the ldap backend. I think this is an error. updateCredentials are as far as I understand not meant for changing a users password in the backend, but for setting the credentials in a cookie, session or the like when logged in (and when changing credentials when logged in ?). It is called by CookieAuthHelper.login(). The comments in ICredentialsUpdatePlugin are a bit misleading I guess.
Changing password is correctly handled by doChangeUser.
regards, Sune W.
|
