在Python 3.x中更改Active Directory用户密码 [英] Changing Active Directory user password in Python 3.x

问题描述

我正在尝试制作一个Python脚本，该脚本将打开与运行AD的服务器的LDAP连接，获取搜索条目(在本例中为名称)，搜索该条目并将用户密码更改为随机生成的密码(以及设置用于在登录时更改密码的选项)，然后向他们发送包含新临时密码的自动安全电子邮件.

I am trying to make a Python script that will open an LDAP connection to a server running AD, take a search entry (in this case a name), search for that entry and change that users password to a randomly generated password (as well as set the option to change password on logon) and then send them an automated secure email containing the new temporary password.

到目前为止，我已经能够连接到服务器，并搜索返回的单个DN.正在生成临时密码，并正在发送电子邮件(尽管未对密码进行哈希处理，并且该电子邮件尚不安全).但是，我找不到从这里出发的任何信息.

So far I have been able to connect to the server, and search for a single DN which returns. The temporary password is being generated, and an email is being sent (although the password is not hashed, and the email is not secure yet). However, I cannot find any information on where to go from here.

我发现使用python更改Windows用户密码但是，我发现这在AD中不能很好地发挥作用，而我发现的Python文档中的其他LDAP似乎已经从2.x过时了，并且不再起作用. ldap3的文档( https://media.readthedocs.org/pdf/ldap3 /stable/ldap3.pdf )似乎也没有真正提及任何内容，并且详尽的Google搜索已无济于事.以前，我对这类编程知识很陌生，只具有较低的水平或学术知识，因此这有点令人沮丧，但是Python是我最强的语言.

I have found Change windows user password with python however I see that this does not play well with AD, and the other LDAP in Python documentation I have been finding seems to be outdated from 2.x and no longer works. The documentation for ldap3 (https://media.readthedocs.org/pdf/ldap3/stable/ldap3.pdf) also doesnt seem to really mention anything for it, and exhaustive Googling has been fruitless. I am new to this kind of programming having only low level or academic knowledge previously, so this has been a bit frustrating but Python is my strongest language.

----------------当前状态的编辑代码-----------------------

----------------EDITED CODE TO CURRENT STATUS-----------------------

#Takes input for name which will be used for search criterion
zid = input("ZID: ")
zid = str(zid).lower()
print(zid)

#Binds session to the server and opens a connection
try:
    server = ldap3.Server('ldap://<IP_Address>', get_info=all)
    conn = ldap3.Connection(server, '[e-mail]' %zid, password = "<something>", auto_bind=True) 
    print("Successfully bound to server.\n")
except:
    print("Unsucessful initialization of <IP_Address>")
    try:
        server = ldap3.Server('ldap://<IP_Address>', get_info=all)
        conn = ldap3.Connection(server, '[e-mail]' %zid, password = "<something>", auto_bind=True) 
        print("Successfully bound to server.\n")
    except:
        print("Unsucessful initialization of <IP_Address>")
        try:
            server = ldap3.Server('ldap://<IP_Address>', get_info=all)
            conn = ldap3.Connection(server, '[e-mail]', password = "<something>", auto_bind=True) %zid 
            print("Successfully bound to server.\n")
        except:
            print("Unsucessful initialization of <IP_Address>")
            sys.exit(0)

#Searches and prints LDAP entries
try:
    base_dn = 'DC=<something>,DC=<something>,DC=<something>,DC=<something>,DC=com'
    zid_filter = '(sAMAccountName=%s)' %zid
    conn.search(base_dn, zid_filter, attributes=['mail'])

    #i.e. "DN: CN=<First Last>,OU=<something>, DC= <something>
    user_dn = str(conn.entries)

    #i.e. "CN=<First Last>"
    front = user_dn.find('C')
    back = user_dn.find(',')
    user_cn = user_dn[front:back]

    #i.e. "<First Last>"
    display_name = user_cn[3:]

    #i.e. "first.last@<something>.com"
    raw_email = str(conn.entries)
    front = raw_email.find('mail: ')
    back = raw_email.find('@<something>.com')
    user_email = raw_email[front + 6:back] + '@<something>.com'
except:
    print("Could not search entries")

#Generates random 12 digit alpha-numeric password
try:
    new_password = ''.join(random.SystemRandom().choice(string.ascii_letters + string.digits) for _ in range(12))
    print(new_password)
    print("New password successfully generated")
except:
    print("New password could not be generated")


#Set and replace AD Password
try:
    conn.extend.microsoft.modify_password(user_dn, None, new_password)
    print ("Active Directory password was set successfully!")
except:
    print('Error setting AD password')
    sys.exit(0)

---

在整个测试过程中，出于安全性目的，关于如何获取/设置用户密码和哈希密码的任何建议吗?对于电子邮件，我想我可以强迫它使用HTTPS，这样就足够了，但是与服务器的连接(将new_password传递给我)很安全.

---

Any suggestions on how to get/set the user password and hash the password for security purposes during this whole ordeal? For the email I imagine I can force it to use HTTPS and that would be sufficient, but the connection to the server passing the new_password to I would like to secure.

推荐答案

ldap3包含用于更改AD密码的特定方法，只需在生成新密码后添加以下内容即可:

ldap3 contains a specific method for changing AD password, just add the following after you generated a new password:

dn = conn.entries[0].entry_get_dn() # supposing you got back a single entry conn.extend.microsoft.modify_password(dn, None, new_password)

dn = conn.entries[0].entry_get_dn() # supposing you got back a single entry conn.extend.microsoft.modify_password(dn, None, new_password)

这应该正确编码密码并将其存储在AD中.

This should properly encode the password and store it in AD.

这篇关于在Python 3.x中更改Active Directory用户密码的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！