php - ldap_mod_replace 返回 true 但密码未更改

Question

我想使用 PHP 更改 LDAP 目录用户的密码。

绑定(bind)到 LDAP 后，我使用 samaccount 名称查找所需用户的 DN，并检索 dn:

$filter="(samaccountname=desiredname.desiredname)";

$result = ldap_search($lh, $personnel_base, $filter) or die(ldap_error($lh));
//$data = ldap_get_entries($lh, $result);
$entry = ldap_first_entry($lh, $result);
$atribute = ldap_get_attributes($lh, $entry);

然后我使用 ldap_mode_replace 更改密码:

    $newpass = "Cevadetest123#!";

    ldap_mod_replace($lh, $dn, array('userpassword' => "{MD5}".base64_encode(pack("H*",md5($newpass) ) ) ) ) or die(ldap_error($lh));

    echo "Password changed!";

尽管我得到 Password Change! 输出，但密码保持不变。

有什么建议吗？

编辑:我刚刚注意到属性 userpassword 确实发生了变化，但要通过 LDAP 登录，我必须使用旧密码!这是什么足球？

Answer 1

我找到了答案。首先，我必须更改的字段是 unicodePwd，它无法读取 - 只能修改。为了写入此字段，您必须首先与 LDAP 建立安全连接。因此主机名是:ldaps://hostname.something.local

下一个重要步骤是在写入字段之前对密码进行加密:

$newpassword="HelloWorld123";
$newpassword = "\"".$newpassword."\"";
$newPass = mb_convert_encoding($newpassword, 'UTF_16LE')

您可以找到完整代码here .

我会将其粘贴在下面，以防链接发生问题:

 ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);
      $ldapconn = ldap_connect('ldaps://127.0.0.1', 636);
      ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
      ldap_set_option($ldapconn, LDAP_OPT_REFERRALS, 0); 
      $ldapuser="ldapuser";
      $ldappwd="*****";

      // search for user
      ldap_bind($ldapconn, "CN=$ldapuser,CN=Users,DC=my,DC=company,DC=example", $ldappwd);

      $res_id = ldap_search( $ldapconn, "CN=Users,DC=my,DC=company,DC=example", "sAMAccountName=$username");
      if ($res_id) {
        $entry_id = ldap_first_entry($ldapconn, $res_id);
        if($entry_id){
          $user_dn = ldap_get_dn($ldapconn, $entry_id);
          if ($user_dn) {
            $ldapbind = ldap_bind($ldapconn, $user_dn, $oldpassword);
            // check if the old password allows a successfull login
            if($ldapbind) {
              if(strcmp($newpassword, $newpassword2)==0){ 

                // create the unicode password
                $newpassword = "\"" . $newpassword . "\"";
                $newPass = mb_convert_encoding($newpassword, "UTF-16LE");

                //rebind as admin to change the password
                ldap_bind($ldapconn, "CN=$ldapuser,CN=Users,DC=my,DC=company,DC=example", $ldappwd);

                $pwdarr = array('unicodePwd' => $newPass);
                if(ldap_mod_replace ($ldapconn, $user_dn, $pwdarr)) { 
                  print "<p class='success'>Change password succeded.</p>\n"; 
                } else { 
                  print "<p class='error'>Change password failed.</p>\n";
                }
              }else{
                print "<p class='error'>New password must be entered the same way twice.</p>\n";
              }
            }else{
              print "<p class='error'>Wrong user name or password.</p>\n";
            }
          } else {
              print "<p class='error'>Couldn't load user data.</p>\n";
          }
        } else {
            print "<p class='error'>Couldn't find user data.</p>\n";
        }
      } else {
          print "<p class='error'>Username was not found.</p>\n";
      }
      if(ldap_error($ldapconn)!="Success"){
        print "<p class='error'>LDAP Error:<br />\n";
        var_dump(ldap_error($ldapconn));
        print "</p>\n";
      }
      @ldap_close($ldapconn);