Reset password expired from API or other ways

[IronCub3]

Hi, i was searching for a method to reset the password of a freeipa user if it's expired, via API or in other ways but it needs to be non interactive.
I know that there is the command: kinit [username] but it's interactive.

To be more specific what i need to do is when a user tries to login via API from the url: "https://ipaserver.com/ipa/session/login_password" if the password is expired use another API call or a command to reset the password.

Thanks in advance

[netoarmando]

Hello @IronCub3! I think the best place is to ask that via IRC or the FreeIPA mailing-lists.

However, I think it needs to be interactive, because the user needs to enter the new password.

In any case, when you submit the login/password as a POST request to the endpoint you mentioned, you'll get a HTTP 401 error (Unauthorized) with the following response header

X-IPA-Rejection-Reason: password-expired

After that, you can make another POST request to https://ipaserver.com/ipa/session/change_password with the fields user, old_password and new_password. This is how the current FreeIPA WebUI works at least.

[IronCub3]

Thank you so much @netoarmando i was missing the end point: "https://ipaserver.com/ipa/session/change_password" this made my work!

PS: sorry for the mistake it was interactive!