active-directory - 使用 PHP 脚本更改 Active Directory 用户密码

Question

我正在尝试获取一个非常简单的 PHP 脚本来更改我的 Active Directory 域中的用户密码。

这是我在网上找到的脚本:

<?php
$uid = 'Mohammed Noureldin';
$newPassword = '5omeGoodP@ssword';
$bindDn = 'CN=Administrator,OU=UsersOU,DC=example,DC=local';
$bindPassword = 'An0therGoodP@ssword';
$baseDn = 'OU=UsersOU,DC=example,DC=local';
$protocolVersion = 3;

$ldap = ldap_connect('localhost');
if (!ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, $protocolVersion))
{
    exit('Failed to set protocol version to '.$protocolVersion);
}
// bind anonymously so that we can verify if the server really is running
ldap_bind($ldap);
if (ldap_errno($ldap) !== 0)
{
    exit('Could not connect to LDAP server');
}

// now bind with the correct username and password
ldap_bind($ldap, $bindDn, $bindPassword);
if (ldap_errno($ldap) !== 0)
{
    exit('ERROR: '.ldap_error($ldap));
}

$searchResults = ldap_search($ldap, $baseDn, 'cn='.$uid);
// no matching records
if ($searchResults === false)
{
    exit('No user found');
}

if (!is_resource($searchResults))
{
    exit('Error in search results.');
}
// create the unicode password
$len = strlen($newPassword);
$newPass = '"';
for ($i = 0; $i < $len; $i++)
{
    $newPass .= "{$newPassword{$i}}\000";
}
$newPass .= '"';

$entry = ldap_first_entry($ldap, $searchResults);
if (!is_resource($entry))
{
    exit('Couldn\'t get entry');
}
$userDn = ldap_get_dn($ldap, $entry);
if (!$userDn)
{
exit('Errrrrrrrrr1');

}
if (!ldap_modify($ldap, $userDn, array('unicodePwd' => $newPass)))
{
exit(ldap_errno($ldap)." ". ldap_error($ldap));

}
?>

此 PHP 页面的输出是此错误消息:

53 Server is unwilling to perform

而且脚本根本不起作用(用户的密码没有更改)。

我知道 AD 将密码存储在 unicodePwd 字段中的主要原则(如果直到现在仍然如此)，并且我知道我必须使用安全连接并且我正在使用它(希望它设置正确)。

我用谷歌搜索了该错误消息，但找不到任何有效的解决方案。

我还尝试了其他一些脚本，但这是迄今为止最好的脚本，因为其他脚本在之前的一些步骤(例如绑定(bind))中给了我一些错误。

我非常感谢任何帮助解决该问题的帮助，甚至另一个函数式脚本可能是个好主意!提前致谢。

Answer 1

除非您通过 SSL/TLS 连接，否则您不能使用此方法更改密码。如果您在 Google 或 Bing 上搜索 unicodePwd 这个词，您已经知道它是因为您将其包含在您的帖子中，那么第一个如果不是 the 第一个结果将是 MSDN documentation for unicodePwd ，在前三句话中指出:

This attribute is written by an LDAP Modify under the following restricted conditions. Windows 2000 operating system servers require that the client have a 128-bit (or better) SSL/TLS-encrypted connection to the DC in order to modify this attribute. On Windows Server 2003 operating system, Windows Server 2008 operating system, Windows Server 2008 R2 operating system, Windows Server 2012 operating system, Windows Server 2012 R2 operating system, and Windows Server 2016 Technical Preview operating system, the DC also permits modification of the unicodePwd attribute on a connection protected by 128-bit (or better) Simple Authentication and Security Layer (SASL)-layer encryption instead of SSL/TLS. In Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, if the fAllowPasswordOperationsOverNonSecureConnection heuristic of the dSHeuristics attribute (section 6.1.1.2.4.1.2) is true and Active Directory is operating as AD LDS, then the DC permits modification of the unicodePwd attribute over a connection that is neither SSL/TLS-encrypted nor SASL-encrypted. The unicodePwd attribute is never returned by an LDAP search.

如果您只是对 unicodePwd 执行简单搜索，同样是第一个您将获得的结果是关于如何执行此操作的STEP BY STEP CODE:

https://support.microsoft.com/en-us/kb/269190