ChangeUserPassword API¶

Obsolete. Use ChangeUserPassword1 instead. ChangeUserPassword remains functional for backward compatibility - it still sets another user's password - but it refuses your own, and new integrations should use ChangeUserPassword1.

Sets another infoRouter user's password; this requires the User Manager administrative role. Your own password is not changed here: use ChangeUserPassword1, which takes your current password.

Endpoint¶

/srv.asmx/ChangeUserPassword

Methods¶

• GET /srv.asmx/ChangeUserPassword?AuthenticationTicket=...&UserName=...&NewPassword=...
• POST /srv.asmx/ChangeUserPassword (form data)
• SOAP Action: http://tempuri.org/ChangeUserPassword

Parameters¶

Response¶

Success Response¶

<root success="true" />

Error Response¶

<root success="false" error="Error message" />

Required Permissions¶

An administrator's account (the sysadmin account or a member of [Administrators]) can be changed by administrators only; anyone else is refused with 4030. See AdministrativeRoles.

• Another user's password: The caller must hold the User Manager administrative role, or manage a library the user belongs to.
• Own password: Refused with 4000, naming CHANGEUSERPASSWORD1. A ticket alone is not enough to change your own password - a stolen ticket would otherwise become a permanent takeover of the account. With Windows authentication on there is no infoRouter password to confirm, and your own password is still accepted here.

Example¶

Request (POST) - an administrator setting another user's password¶

POST /srv.asmx/ChangeUserPassword HTTP/1.1
Content-Type: application/x-www-form-urlencoded

AuthenticationTicket=admin-ticket-guid&UserName=jsmith&NewPassword=NewSecure!99

Request (SOAP 1.1)¶

POST /srv.asmx HTTP/1.1
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://tempuri.org/ChangeUserPassword"

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <ChangeUserPassword xmlns="http://tempuri.org/">
      <AuthenticationTicket>abc123-def456</AuthenticationTicket>
      <UserName>jsmith</UserName>
      <NewPassword>NewSecure!99</NewPassword>
    </ChangeUserPassword>
  </soap:Body>
</soap:Envelope>

JavaScript¶

Every call answers XML with HTTP 200, success or not, so success is the thing to branch on and errorCode is the number to report. call below is used by the sample on every page.

async function call(action, params) {
  const response = await fetch(`/srv.asmx/${action}?${new URLSearchParams(params)}`);
  const root = new DOMParser()
    .parseFromString(await response.text(), 'text/xml')
    .documentElement;

  if (root.getAttribute('success') !== 'true') {
    throw new Error(`${root.getAttribute('errorCode')}: ${root.getAttribute('error')}`);
  }
  return root;
}

Sets another account's password outright, so it needs a ticket with the rights to do it - this is not the call a user changes their own password with.

await call('ChangeUserPassword', {
  authenticationTicket: ticket,
  UserName: 'jsmith',
  NewPassword: 'the new one'
});

The old password stops working immediately, including any session holding a ticket issued under it.

Notes¶

• Same-password restriction: The new password must differ from the user's current password. Submitting the same password is rejected.
• Password policy enforcement: The new password is validated against the application's password complexity rules (minimum length, required character types, etc.) as configured in GetAuthenticationAndPasswordPolicy. If the password does not comply, the call fails and the response error attribute contains a descriptive message identifying the unmet rule.
• No current password: Setting another user's password takes no password of theirs - the caller's right is what decides. Your own password needs your current one, through ChangeUserPassword1.
• Use ChangePasswordUsingSecretText for unauthenticated resets: If the user has forgotten their password and cannot log in, use the ForgotPassword / ForgotPasswordByUserName + ChangePasswordUsingSecretText flow instead.

Related APIs¶

• ChangeUserPassword1 - Change your own password (takes the current one) or another user's
• ChangePasswordUsingSecretText - Reset password using a one-time email token (no ticket required)
• ForgotPassword - Initiate a password reset by email address
• ForgotPasswordByUserName - Initiate a password reset by user name
• GetAuthenticationAndPasswordPolicy - Retrieve the current password complexity policy

Error Codes¶

The errorCode values this operation returns, checked against a running server: