php - 使用 PHP LDAP 更改(而不是重置)用户密码

Question

我正在尝试使用 php-ldap 更改 Microsoft 事件目录中的用户密码。问题是当尝试使用 ldap_mod_replace 更改密码时，它没有更改而是重置密码，这不是我想要的，因为不允许我的用户重置他们自己的密码。

事件目录基于 Microsoft 服务器 2016，我的应用程序在使用 PHP 7.2 的 IIS 网络服务器上运行。

// open LDAP connection 
$ldap_connection = $this->connectToActiveDirectory();

if (@ldap_bind($ldap_connection, $this->ldap_username . '@' . env('LDAP_DOMAIN', 'localhost'), $request->oldPassword)) {
    // LDAP connection established

    $dn = $request->userdn; // distinguished name of user

    /* 
     The DC requires that the password value be specified in a UTF-16 encoded Unicode
     string containing the password surrounded by quotation marks, which has been BER-encoded
     as an octet string per the Object(Replica-Link) syntax.
     */
    $newPassword = "\"" .$request->password. "\"";
    $utf16Password = ""; // converted password
    $passwordLength = strlen($newPassword);
    for ($i = 0; $i < $passwordLength; $i++) {
        $utf16Password .= "{$newPassword{$i}}\000";
    }

    $passwordEntry = array('unicodePwd' => $utf16Password);

    // Set new password
    if(@ldap_mod_replace($ldap_connection, $dn, $passwordEntry)) {
        // Successful   
    } else {
        // Error, probably not enough permissions

        return back(); // Redirect user to previous page
    }

    ldap_unbind($ldap_connection); // Close LDAP connection

    return redirect('/logout'); // Redirect user to logout
}

我想修改密码而不是重置密码，我找不到解决办法。也许你们中的一些人遇到过这个问题，非常感谢您的帮助!

Answer 1

根据documentation for the unicodePwd attribute ，这就是你的做法:

If the Modify request contains a delete operation containing a value Vdel for unicodePwd followed by an add operation containing a value Vadd for unicodePwd, the server considers the request to be a request to change the password. ... Vdel is the old password, while Vadd is the new password.

简而言之，您需要在一个 LDAP 请求中删除该值并添加该值。在 PHP 中，这意味着使用 ldap_modify_batch功能。事实上，在该文档中，there is an example如何更改密码:

<?php
function adifyPw($pw)
{
    return iconv("UTF-8", "UTF-16LE", '"' . $pw . '"');
}

$dn = "cn=Jack Smith-Jones,ou=Wizards,dc=ad,dc=example,dc=com";
$modifs = [
    [
        "attrib"  => "unicodePwd",
        "modtype" => LDAP_MODIFY_BATCH_REMOVE,
        "values"  => [adifyPw("Tr0ub4dor&3")],
    ],
    [
        "attrib"  => "unicodePwd",
        "modtype" => LDAP_MODIFY_BATCH_ADD,
        "values"  => [adifyPw("correct horse battery staple")],
    ],
];
ldap_modify_batch($connection, $dn, $modifs);