使用PHP发行更新AD密码的问题 [英] Issue updating AD password using PHP
问题描述
您好，我编写了以下脚本来更新特定用户的密码
<?php
function create_ldap_connection() {
$ip = "192.168.168.1";
$ldaps_url = "192.168.168.1";
$port = 389;
$ldap_conn = ldap_connect($ldaps_url, $port) or die("Sorry! Could not connect to LDAP server ($ip)");
$password = "password";
$binddn = "CN=Administrator,CN=Users,DC=ad,DC=test,DC=com";
$result = ldap_bind( $ldap_conn, $binddn, $password ) or die(" Error: Couldn't bind to server using provided credentials!");
if($result) {
return $ldap_conn;
}
else {
die (" Error: Couldn't bind to server with supplied credentials!");
}
}
function get_user_dn($ldap_conn, $user_name) {
/* Write the below details as per your AD setting */
$basedn = "OU=ITS Users,DC=ad,DC=test,DC=com";
/* Search the user details in AD server */
$searchResults = ldap_search($ldap_conn, $basedn, $user_name);
if(!is_resource($searchResults)) die('Error in search results.');
/* Get the first entry from the searched result */
$entry = ldap_first_entry($ldap_conn, $searchResults);
$info = ldap_get_entries($ldap_conn, $searchResults);
echo $info["count"]." entries returned\n";
return ldap_get_dn($ldap_conn, $entry);
}
function pwd_encryption($newPassword) {
$newPassword = "\"" . $newPassword . "\"";
$len = strlen($newPassword);
$newPassw = "";
for ($i = 0; $i < $len; $i++) {
$newPassw .= "{$newPassword {$i}}\000";
}
$userdata["unicodePwd"] = $newPassw;
return $userdata;
}
$user_name = "(|(sn=archieg*)(SamAccountName=archieg*))";
$user_password = "password!1234";
$ldap_conn = create_ldap_connection();
$userDn = get_user_dn($ldap_conn, $user_name);
$userdata = pwd_encryption ($user_password);
print_r($userdata);
//$result = ldap_mod_replace($ldap_conn, $userDn , $userdata); /* Check whether the password updated successfully or not. */
$result = ldap_modify($ldap_conn, $userDn , $userdata);
if($result) {
echo "Success attempting to modify password in AD";
}
else {
echo "Error: Please try again later!\n";
$e = ldap_error($ldap_conn);
$e_no = ldap_errno($ldap_conn);
echo $e . "\n";
echo $e_no . "\n";
}
?>
但是，当我运行此程序时，出现以下错误，
[root@web chpasswd]# php ad_change.php
PHP Warning: Module 'intl' already loaded in Unknown on line 0
1 entries returned
Array
(
[unicodePwd] => "password!1234"
)
Error: Please try again later!
Server is unwilling to perform
53
[root@web chpasswd]#
我在这里做错了什么?我一直在尝试加密，但这也没有帮助.我有Windows Server 2012 R2 Active Directory.
非常感谢
结果表明，这与我的代码无关.我必须在服务器上设置证书颁发机构.这就是我所做的，
确保您的PHP安装同时启用了ldap和openssl扩展.
Windows/Linux过程
验证ldap.conf文件设置.
对于Windows，请验证C:\ openldap \ sysconf \ ldap.conf文件是否存在.
对于Linux，请验证/etc/openldap/ldap.conf文件是否存在.如果没有，请创建它.
对于Linux和Windows，ldap.conf文件应包含以下行:**-
TLS_REQCERT永远不会
如果您希望php使用颁发证书的证书颁发机构来验证ldap服务器的ssl证书，则需要在此处放置根证书: 导出受信任的根证书. (有关详细信息，请参阅如何通过SSL测试LDAP中的步骤1.)
使用此命令将DER转换为PEM:
openssl x509 -in RootCert.der -inform DER -out RootCert.pem -outform PEM
在Windows上，您可以从以下两个站点下载openssl二进制文件:
http://gnuwin32.sourceforge.net/packages.html
http://www.ShininglightPro.com/
现在将rootcert.pem复制到certs文件夹:
对于Linux，是/etc/openldap/cert/rootcert.pem
对于Windows，C:\ openldap \ sysconf \ certs \ rootcert.pem
对于Linux和Windows，ldap.conf文件应包含以下行:
(Linux)TLS_CACERT/etc/openldap/cert/rootcert.pem
(Windows)TLS_CACERT c:\ OpenLDAP \ sysconf \ certs \ rootcert.pem
您可以在 https://github.com/achintha85/AD_User_Password_Change_PHP 中找到我的最新代码
希望这对以后的人有帮助.
Hi I have written following script to update a password for a specific user
<?php
function create_ldap_connection() {
$ip = "192.168.168.1";
$ldaps_url = "192.168.168.1";
$port = 389;
$ldap_conn = ldap_connect($ldaps_url, $port) or die("Sorry! Could not connect to LDAP server ($ip)");
$password = "password";
$binddn = "CN=Administrator,CN=Users,DC=ad,DC=test,DC=com";
$result = ldap_bind( $ldap_conn, $binddn, $password ) or die(" Error: Couldn't bind to server using provided credentials!");
if($result) {
return $ldap_conn;
}
else {
die (" Error: Couldn't bind to server with supplied credentials!");
}
}
function get_user_dn($ldap_conn, $user_name) {
/* Write the below details as per your AD setting */
$basedn = "OU=ITS Users,DC=ad,DC=test,DC=com";
/* Search the user details in AD server */
$searchResults = ldap_search($ldap_conn, $basedn, $user_name);
if(!is_resource($searchResults)) die('Error in search results.');
/* Get the first entry from the searched result */
$entry = ldap_first_entry($ldap_conn, $searchResults);
$info = ldap_get_entries($ldap_conn, $searchResults);
echo $info["count"]." entries returned\n";
return ldap_get_dn($ldap_conn, $entry);
}
function pwd_encryption($newPassword) {
$newPassword = "\"" . $newPassword . "\"";
$len = strlen($newPassword);
$newPassw = "";
for ($i = 0; $i < $len; $i++) {
$newPassw .= "{$newPassword {$i}}\000";
}
$userdata["unicodePwd"] = $newPassw;
return $userdata;
}
$user_name = "(|(sn=archieg*)(SamAccountName=archieg*))";
$user_password = "password!1234";
$ldap_conn = create_ldap_connection();
$userDn = get_user_dn($ldap_conn, $user_name);
$userdata = pwd_encryption ($user_password);
print_r($userdata);
//$result = ldap_mod_replace($ldap_conn, $userDn , $userdata); /* Check whether the password updated successfully or not. */
$result = ldap_modify($ldap_conn, $userDn , $userdata);
if($result) {
echo "Success attempting to modify password in AD";
}
else {
echo "Error: Please try again later!\n";
$e = ldap_error($ldap_conn);
$e_no = ldap_errno($ldap_conn);
echo $e . "\n";
echo $e_no . "\n";
}
?>
However when I run this I get the following error,
[root@web chpasswd]# php ad_change.php
PHP Warning: Module 'intl' already loaded in Unknown on line 0
1 entries returned
Array
(
[unicodePwd] => "password!1234"
)
Error: Please try again later!
Server is unwilling to perform
53
[root@web chpasswd]#
What am I doing wrong here? I've been playing around with the encryption but that didn't help either. I have Windows Server 2012 R2 Active Directory.
Many Thanks
It worked out that this wasn't a issue with my code. I had to setup certificate authority on my server. This is what I did,
Make sure your PHP install has both the ldap and openssl extensions enabled.
Windows/Linux Procedure
Verify the ldap.conf file settings.
For Windows, verify that the C:\openldap\sysconf\ldap.conf file exists.
For Linux, verify that the /etc/openldap/ldap.conf file exists. If it does not, create it.
For both Linux and Windows, the ldap.conf file should contain this line: ** -
TLS_REQCERT never
If you want php to verify the ldap server's ssl certificate with the Certificate Authority that issued the certificate, you need to put the root certificate here: Export the trusted root Certificate. (For details, see Step 1 in How to test LDAP over SSL).
Use this command to convert the DER to PEM:
openssl x509 -in RootCert.der -inform DER -out RootCert.pem -outform PEM
On Windows you can download openssl binaries from these two sites:
http://gnuwin32.sourceforge.net/packages.html
http://www.ShininglightPro.com/
Now copy the rootcert.pem to the certs folder:
For Linux, /etc/openldap/cert/rootcert.pem
For Windows, C:\openldap\sysconf\certs\rootcert.pem
For both Linux and Windows, the ldap.conf file should contain this line:
(Linux) TLS_CACERT /etc/openldap/cert/rootcert.pem
(Windows) TLS_CACERT c:\OpenLDAP\sysconf\certs\rootcert.pem
You can find my latest code on https://github.com/achintha85/AD_User_Password_Change_PHP
Hope this helps someone in the future.
这篇关于使用PHP发行更新AD密码的问题的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
