使用 PHP LDAP 更改（而不是重置）用户密码

Question

我正在尝试使用 php-ldap 更改 Microsoft 活动目录中的用户密码。问题是当尝试使用 ldap_mod_replace 更改密码时，它没有更改而是重置密码，这不是我想要的，因为不允许我的用户重置他们自己的密码。

活动目录基于 Microsoft server 2016，我的应用程序运行在 IIS 网络服务器上使用 PHP 7.2.

// open LDAP connection 
$ldap_connection = $this->connectToActiveDirectory();

if (@ldap_bind($ldap_connection, $this->ldap_username . '@' . env('LDAP_DOMAIN', 'localhost'), $request->oldPassword)) {
    // LDAP connection established

    $dn = $request->userdn; // distinguished name of user

    /* 
     The DC requires that the password value be specified in a UTF-16 encoded Unicode
     string containing the password surrounded by quotation marks, which has been BER-encoded
     as an octet string per the Object(Replica-Link) syntax.
     */
    $newPassword = "\"" .$request->password. "\"";
    $utf16Password = ""; // converted password
    $passwordLength = strlen($newPassword);
    for ($i = 0; $i < $passwordLength; $i++) {
        $utf16Password .= "{$newPassword{$i}}[=11=]0";
    }

    $passwordEntry = array('unicodePwd' => $utf16Password);

    // Set new password
    if(@ldap_mod_replace($ldap_connection, $dn, $passwordEntry)) {
        // Successful   
    } else {
        // Error, probably not enough permissions

        return back(); // Redirect user to previous page
    }

    ldap_unbind($ldap_connection); // Close LDAP connection

    return redirect('/logout'); // Redirect user to logout
}

我想修改密码而不是重置密码，我找不到解决办法。也许你们中的一些人遇到过这个问题，非常感谢您的帮助！

Answer 1

根据 documentation for the unicodePwd attribute，您是这样操作的：

If the Modify request contains a delete operation containing a value Vdel for unicodePwd followed by an add operation containing a value Vadd for unicodePwd, the server considers the request to be a request to change the password. ... Vdel is the old password, while Vadd is the new password.

简而言之，您需要在一个LDAP 请求中删除值并添加值。在PHP中，这意味着使用如何更改密码的ldap_modify_batch function. In fact, in that documentation, there is an example：

<?php
function adifyPw($pw)
{
    return iconv("UTF-8", "UTF-16LE", '"' . $pw . '"');
}

$dn = "cn=Jack Smith-Jones,ou=Wizards,dc=ad,dc=example,dc=com";
$modifs = [
    [
        "attrib"  => "unicodePwd",
        "modtype" => LDAP_MODIFY_BATCH_REMOVE,
        "values"  => [adifyPw("Tr0ub4dor&3")],
    ],
    [
        "attrib"  => "unicodePwd",
        "modtype" => LDAP_MODIFY_BATCH_ADD,
        "values"  => [adifyPw("correct horse battery staple")],
    ],
];
ldap_modify_batch($connection, $dn, $modifs);

使用 PHP LDAP 更改（而不是重置）用户密码

Changing (not resetting) a users password using PHP LDAP

php

ldap

active-directory

laravel