Query regarding Active Directory Global Catalog

[211025]

Hi,

I have a query regarding Active Directory Global Catalog:

I have set up a forest that has three domain controllers
1. universal.com
2. earth.universal.com (child domain)
3. galaxy.com
Here the 1st server is the Global Catalog (GC) server also.
Now I have an application that connects to GC over LDAP. I can autheticate and authorize the users lying on any of the domains using the connection.
I have tested this on GC SSL port 3269 and GC non SSL port 3268.
For this I had to modify the userPassword attibute in schema so that it is replicated in GC. Without explicitly replicating the userPassword I was not able to authenticate any user.
Now the requirement is that I need to change the password of the user from my client application over LDAP. But I am not able to do so.
The error I am getting is LDAP error 53. DSA unwilling to perform.
Is there any way I can change the password for users in GC from my client application that works over LDAP.
Thanks
Deepesh

 

[mlichstein]

The GC was not designed for this. Your application should be connecting directly to LDAP (port 389) on a domain controller, rather than the GC.

That way, it would be able to do LDAP queries on the full read/write copy of the database.