I need to implement a web app for a self-service change password use case for on-premise Active Directory users, which is accessible over the internet.

The service must allow the users to set a new password, so I need to send the new password or a hash of it (if supported) to the on-premise AD. The user on the web is authenticated with another federated service and is not required to provide the AD user password. In this way the user can set a new password in the case he forgot it.

What is the best architecture?

  • Host the service in a server in the DMZ and allow communication from the server to the AD.

-> I would like to avoid this because it require to open a TCP port, and probably it is not allowed by the company policy

  • Host the service in a server in the cloud and create a server behind the firewall that communicates with the server via a message protocol (STOMP for example in RabbitMQ over WebSocket) in order to acquire the requests from the web and apply to AD.

  • Any alternatives/suggestions?

1 Answer 1


You really shouldn't do this, the service used should authenticate the user by other means (2FA code, older password, security question, etc.)

If you are using AAD/O365/Hybrid you can also use the SelfService password reset tool from Microsoft.

Or if you're inly on-prem you can check the following solutions:

ADService Plus

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .