ldap_mod_replace() [function.ldap-mod-replace]: 修改:服务器不愿意执行

2022-01-07 00:00:00 ldap active-directory php windows-server-2008-r2

出现错误:

服务器不愿意执行

同时通过 PHP 更改 AD 中的 unicodePwd.但是，我可以搜索、添加、删除和修改用户的任何属性.

while changing unicodePwd in AD through PHP. However, I'm able to search, add, remove and modify any attributes of the users.

使用Administrator账号绑定，admin拥有修改任何用户密码的全部权限.

Using Administrator account to bind and admin has full rights to change passwords of any users.

这是我正在使用的代码:

Here's the code I'm using:

<?php
$dn = "CN=Vishal Makwana,OU=Address Book,DC=example,DC=com";
$ad = ldap_connect("ldap://example.com")
      or die("Couldn't connect to AD!");
ldap_set_option($ad, LDAP_OPT_PROTOCOL_VERSION, 3);
$bd = ldap_bind($ad,"admin@example.com","admin1");

    if($bd) {
        echo "AD bind successfully";  
      }
    else {
        echo "Couldn't bind AD";;
    }

$user["unicodePwd"] = "asdf1234";

$result = ldap_mod_replace($ad, $dn, $user);
if ($result) echo "User modified!"; else
             echo "There was a problem!";

ldap_unbind($ad);
?>

推荐答案

要通过 LDAP 在 AD 中正确设置密码，您需要做很多事情.

There are a number of things you need to get exactly right to set a password in AD via LDAP.

  • 您需要使用 SSL 连接 (ldaps://)

  • you need to use an SSL connection (ldaps://)

密码需要用引号括起来

(引用)密码需要以 16 位 unicode (UTF-16LE) 编码

the (quoted) password needs to be encoded in 16-bit unicode (UTF-16LE)

假设你要设置的密码是普通的ascii字符，可以通过在ascii字符串的每个字节后添加一个00字节来完成unicode转换，如此代码示例.

Assuming the password you're trying to set is ordinary ascii characters, the unicode conversion can be accomplished by adding a 00 byte after each byte of the ascii string, as shown in this code sample.

所以你的例子看起来像:

So your example would instead look like:

$newpassword = "asdf1234";
$newpassword = """ . $newpassword . """;
$len = strlen($newpassword);
for ($i = 0; $i < $len; $i++) $newpass .= "{$newpassword{$i}}00";
$user["unicodePwd"] = $newpass;

相关文章