我正在尝试使用 php-ldap 更改 Microsoft 事件目录中的用户密码。问题是当尝试使用 ldap_mod_replace
更改密码时,它没有更改而是重置密码,这不是我想要的,因为不允许我的用户重置他们自己的密码。
事件目录基于 Microsoft 服务器 2016,我的应用程序在使用 PHP 7.2 的 IIS 网络服务器上运行。
// open LDAP connection
$ldap_connection = $this->connectToActiveDirectory();
if (@ldap_bind($ldap_connection, $this->ldap_username . '@' . env('LDAP_DOMAIN', 'localhost'), $request->oldPassword)) {
// LDAP connection established
$dn = $request->userdn; // distinguished name of user
/*
The DC requires that the password value be specified in a UTF-16 encoded Unicode
string containing the password surrounded by quotation marks, which has been BER-encoded
as an octet string per the Object(Replica-Link) syntax.
*/
$newPassword = "\"" .$request->password. "\"";
$utf16Password = ""; // converted password
$passwordLength = strlen($newPassword);
for ($i = 0; $i < $passwordLength; $i++) {
$utf16Password .= "{$newPassword{$i}}\000";
}
$passwordEntry = array('unicodePwd' => $utf16Password);
// Set new password
if(@ldap_mod_replace($ldap_connection, $dn, $passwordEntry)) {
// Successful
} else {
// Error, probably not enough permissions
return back(); // Redirect user to previous page
}
ldap_unbind($ldap_connection); // Close LDAP connection
return redirect('/logout'); // Redirect user to logout
}
我想修改密码而不是重置密码,我找不到解决办法。也许你们中的一些人遇到过这个问题,非常感谢您的帮助!
最佳答案
根据documentation for the unicodePwd
attribute ,这就是你的做法:
If the Modify request contains a delete operation containing a value Vdel for unicodePwd followed by an add operation containing a value Vadd for unicodePwd, the server considers the request to be a request to change the password. ... Vdel is the old password, while Vadd is the new password.
简而言之,您需要在一个 LDAP 请求中删除该值并添加该值。在 PHP 中,这意味着使用 ldap_modify_batch
功能。事实上,在该文档中,there is an example如何更改密码:
<?php
function adifyPw($pw)
{
return iconv("UTF-8", "UTF-16LE", '"' . $pw . '"');
}
$dn = "cn=Jack Smith-Jones,ou=Wizards,dc=ad,dc=example,dc=com";
$modifs = [
[
"attrib" => "unicodePwd",
"modtype" => LDAP_MODIFY_BATCH_REMOVE,
"values" => [adifyPw("Tr0ub4dor&3")],
],
[
"attrib" => "unicodePwd",
"modtype" => LDAP_MODIFY_BATCH_ADD,
"values" => [adifyPw("correct horse battery staple")],
],
];
ldap_modify_batch($connection, $dn, $modifs);
关于php - 使用 PHP LDAP 更改(而不是重置)用户密码,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/57492509/