<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div>The currently assumption is that all IPA users can login into Unix/Linux machines to change their IPA password, or reset their expired password. </div><div><br></div><div> But this is not available all the time, so a more general alternative -- web UI -- will be more appreciated. The basic requirements are:</div><div><br></div><div> 1, The web UI accept user's passwords, expired is also accepted.</div><div> </div><div> 2, the authentication is based on IPA Kerberos.</div><div><br></div><div> 3, authenticated regular IPA user can only reset his/her password only.</div><div><br></div><div> 4, (bonus) authenticated admin users can alter other users' password as well.</div><div><br></div><div><br></div><div>Thanks.</div><div><br></div><div>--Gelen</div><div><br></div><div><br></div></div></body></html>