starred/lldap-lldap

Fork 0

mirror of https://github.com/lldap/lldap.git synced 2026-04-26 08:45:55 +03:00

[GH-ISSUE #1187] [FEATURE REQUEST] Password change time attribute #424

New issue

Closed

opened 2026-02-27 08:17:13 +03:00 by kerem · 5 comments

kerem commented

2026-02-27 08:17:13 +03:00

Owner

Originally created by @jip149 on GitHub (Jun 5, 2025).
Original GitHub issue: https://github.com/lldap/lldap/issues/1187

Stalwart recently changed their ldap client implementation and now requires an attribute to know when a password has been changed. From their doc:

Since password hashes are not available in bind authentication, Stalwart cannot detect password changes based on stored credentials in order to invalidate existing OAuth tokens. Therefore, it is essential to configure the secret-changed attribute to track password changes. This attribute should contain a value that changes whenever the user's password is updated, such as a timestamp or version hash. This allows Stalwart to recognize when a password has changed, even without access to the hash.

Can lldap implement such attribute?

Originally created by @jip149 on GitHub (Jun 5, 2025). Original GitHub issue: https://github.com/lldap/lldap/issues/1187 Stalwart recently changed their ldap client implementation and now requires an attribute to know when a password has been changed. From their doc: > Since password hashes are not available in bind authentication, Stalwart cannot detect password changes based on stored credentials in order to invalidate existing OAuth tokens. Therefore, it is essential to configure the secret-changed attribute to track password changes. This attribute should contain a value that changes whenever the user's password is updated, such as a timestamp or version hash. This allows Stalwart to recognize when a password has changed, even without access to the hash. Can lldap implement such attribute?

kerem

2026-02-27 08:17:13 +03:00

closed this issue
added the
enhancement
label

kerem commented

2026-02-27 08:17:13 +03:00

Author

Owner

@nitnelave commented on GitHub (Jun 5, 2025):

There was a discussion about that recently on Discord.

I think this is a perfect example of what a plugin would be great for (once we merge plugin support)

@nitnelave commented on GitHub (Jun 5, 2025): There was a discussion about that recently on Discord. I think this is a perfect example of what a plugin would be great for (once we merge plugin support)

kerem commented

2026-02-27 08:17:13 +03:00

Author

Owner

@choucavalier commented on GitHub (Jul 4, 2025):

That just broke my stalwart mail server and I had to downgrade stalwart for now

@choucavalier commented on GitHub (Jul 4, 2025): That just broke my stalwart mail server and I had to downgrade stalwart for now

kerem commented

2026-02-27 08:17:14 +03:00

Author

Owner

@nitnelave commented on GitHub (Jul 4, 2025):

That just broke my stalwart mail server and I had to downgrade stalwart for now

One workaround, for now, is to use the "user created" timestamp for the password. It means it won't be updated and the oauth tokens not invalidated, but it works.

@nitnelave commented on GitHub (Jul 4, 2025): > That just broke my stalwart mail server and I had to downgrade stalwart for now One workaround, for now, is to use the "user created" timestamp for the password. It means it won't be updated and the oauth tokens not invalidated, but it works.

kerem commented

2026-02-27 08:17:14 +03:00

Author

Owner

@alex-savin commented on GitHub (Aug 12, 2025):

@nitnelave Could you please share the example how you done it?
Thank you in advance

@alex-savin commented on GitHub (Aug 12, 2025): @nitnelave Could you please share the example how you done it? Thank you in advance

kerem commented

2026-02-27 08:17:14 +03:00

Author

Owner

@nitnelave commented on GitHub (Aug 12, 2025):

@alex-savin the plugin API is not merged yet, so there's no way to implement it right now.

@nitnelave commented on GitHub (Aug 12, 2025): @alex-savin the plugin API is not merged yet, so there's no way to implement it right now.

kerem referenced this issue

2026-02-27 09:09:32 +03:00

[PR #424] [MERGED] Wikijs Example #733