Win ldap php 改密码,PHP和IIS：用于密码更改的LDAPS连接

我的目标是通过使用PHP& amp;的Web界面更改Active Directory中的密码. IIS.

在遵循这些说明之前,我无法为LDAPS连接绑定到AD,但是在遵循这些说明之后,它似乎已成功连接,但是在尝试更改“ unicodePwd”时出现“服务器不愿意执行”错误值.

请注意,以下代码将成功更改AD中用户的任何其他值.

$ldaprdn = 'CN=Admin User,OU=*******,OU=Staff,OU=********,DC=********,DC=*******,DC=******,DC=*****';

$ldappass = "*******"; // associated password

$ldapconn = ldap_connect("ldaps://***.***.***.***:636" ) or die("Could not connect to LDAP server.");

ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);

ldap_set_option($ldapconn, LDAP_OPT_REFERRALS, 0);

if ($ldapconn) {

// binding to ldap server

$ldapbind = ldap_bind($ldapconn, $ldaprdn, $ldappass);

// verify binding

if ($ldapbind) {

echo "LDAP bind successful...";

$username = '******';

$dn = "CN=Bob Smith,OU=******,OU=******,OU=******,DC=******,DC=******,DC=******,DC=******";

$newPassword = 'blah';

$newEntry = array('unicodePwd' => encodePwd($newPassword));

print_r($newEntry);

if(ldap_mod_replace($ldapconn, $dn, $newEntry)) {

print "

succeded

";

} else {

print "

failed

";

}

print_r(ldap_error($ldapconn));

} else {

echo "LDAP bind failed...";

print_r(ldap_error($ldapconn));

}

}

// Credit: http://www.cs.bham.ac.uk/~smp/resources/ad-passwds/

function encodePwd($pw) {

$newpw = '';

$pw = "\"" . $pw . "\"";

$len = strlen($pw);

for ($i = 0; $i < $len; $i++)

$newpw .= "{$pw{$i}}\000";

$newpw = base64_encode($newpw);

return $newpw;

}

?>

解决方法:

解决了！！

事实证明,遵循Ashley Knowles tutorial,我已成功通过LDAP建立SSL连接,但是由于密码编码而发生了错误.

成功的密码编码功劳归功于此forum post上的hd42,这使我能够相应地修改自己的代码.

因此,一旦在IIS服务器上的硬盘驱动器中正确安装了证书等,此代码将通过IIS Web服务器使用PHP成功修改Active Directory中的用户密码(假设$ldaprdn用户具有足够的管理员权限)：

$ldaprdn = 'CN=Admin User,OU=*******,OU=Staff,OU=********,DC=********,DC=*******,DC=******,DC=*****';

$ldappass = "*******"; // associated password

$ldapconn = ldap_connect("ldaps://***.***.***.***:636" ) or die("Could not connect to LDAP server.");

ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);

ldap_set_option($ldapconn, LDAP_OPT_REFERRALS, 0);

if ($ldapconn) {

// binding to ldap server

$ldapbind = ldap_bind($ldapconn, $ldaprdn, $ldappass);

// verify binding

if ($ldapbind) {

echo "LDAP bind successful...";

$dn = "CN=Bob Smith,OU=******,OU=******,OU=******,DC=******,DC=******,DC=******,DC=******";

$newPassword = 'blah';

$newPassword = "\"" . $newPassword . "\"";

$newPass = mb_convert_encoding($newPassword, "UTF-16LE");

$newEntry = array('unicodePwd' => $newPass);

print_r($newEntry);

if(ldap_mod_replace($ldapconn, $dn, $newEntry)) {

print "

succeded

";

} else {

print "

failed

";

}

print_r(ldap_error($ldapconn));

} else {

echo "LDAP bind failed...";

print_r(ldap_error($ldapconn));

}

}

标签：active-directory,ldap,iis,php

来源： https://codeday.me/bug/20191031/1974308.html