Page 10 - Modifying Active Directory passwords through PHP and IIS

Dev Shed Forums Sponsor:

#136

August 2nd, 2006, 06:41 PM

dpowell_eau

Registered User

Join Date: Aug 2006

Posts: 1

Time spent in forums: 2 m 25 sec
Reputation Power: 0

Instructions for setting up SSL and LDAP

Quote:

Originally Posted by Relnor

That's what I'm doing now. I'd just like to see if it can be done the other way MS gives.

I've read through this long thread but didn't see links to instructions on the process of setting up an Active Directory LDAP to accept SSL connections. Maybe I missed it but if someone has that information, I would greatly appreciate it.

#137

August 16th, 2006, 05:50 AM

acropia

Registered User

Join Date: Jun 2004

Location: Drachten, FRL, NL

Posts: 6

Time spent in forums: 27 m 3 sec
Reputation Power: 0

After some hours of research I found an article which tells me how to setup the SSL part for this topic...

It is on: http://greg.cathell.net/php_ldap_ssl.html

With that artical, and the code on Page 7 on this forum, it worked for my situation.

Comments on this post

pabloj agrees: Thanks for your feedback

#138

September 20th, 2006, 03:58 PM

elsint

Contributing User

Join Date: Aug 2006

Posts: 39

Time spent in forums: 12 h 8 m 58 sec
Reputation Power: 3

Ssl Ssl Ssl

I also have this SSL problem.

I have a Windows XP computer running PHP 5.1.6 and Apache 2.x.

in ldap.conf file I was using TLS_REQCERT never and I could make SSL connections.

Then I installed IIS 5.1. Now I can't make the SSL connection. I read the whole thread but couldn't solve the problem.

It seems like it doesn't even read the ldap.conf file anymore.

#139

September 20th, 2006, 04:40 PM

elsint

Contributing User

Join Date: Aug 2006

Posts: 39

Time spent in forums: 12 h 8 m 58 sec
Reputation Power: 3

Oh, at last I found it what the problem was.

The problem was the permission on certificates. You need to set the permission wide enough PHP can read them!

Do not pass over this point when you are trying to establish a secure connection as it took my many hours to find!

I hope this will help other people trying to establish secure connection.

#140

November 17th, 2006, 02:04 PM

blaqb0x

Join Date: Mar 2004

Posts: 87

Time spent in forums: 12 h 16 m 20 sec
Reputation Power: 13

Hey,

I noticed that people had trouble getting ldaps to work w/ php.

I found that you need to have /etc/openldap/ldap.conf configured e.g. have entries like this

tls_checkpeer yes
tls_cacertfile /srv/certs/certauth.pem
tls_reqcert never

Usually, one uses the /etc/ldap.conf file which PHP doesn't use. If you use ldaps for user authentication on a linux box using PAM/SASL the /etc/ldap.conf file is used. To be safe keep both /etc/ldap.conf and /etc/openldap/ldap.conf identical.

#141

July 4th, 2007, 04:22 AM

zsolesz

Registered User

Join Date: Jul 2007

Posts: 1

Time spent in forums: 5 m
Reputation Power: 0

howto configure ssl

a bit offtopic, but i'll try.

So, I also want to change the user's password using ldap and php, from debian, the ad is on a windows 2003 server.

now i'm not a linux expert, how can I enable the ssl in debian/php/apache2?

btw, its guaranteed that the windows side uses ssl?

#142

August 20th, 2007, 02:55 PM

Qbfinest83

Registered User

Join Date: Aug 2007

Posts: 6

Time spent in forums: 1 h 18 m 4 sec
Reputation Power: 0

Hey guys I am having the same problems cant connect using ldaps:// . I have tried everything in the link acropia provided to greg.cathell website

1. Configure PHP to load the LDAP and SSL modules
2. Copy DLL files to Windows system32 directory
3. Place ldap.conf file in C:\openldap\sysconf
5. Obtain certificate for AD server (.cer file)
6. Convert cert from .cer to .pem format
7. Install the certificate by referencing it in the ldap.conf file

I did all but 4. Enable SSL over LDAP on Windows Domain Controller because I am on Windows XP. I am able to connect the AD fine and create a user (even though the account is disable off the bat) but I cant change the password. If anyone can help me try to get ldaps:// to working.

Windows XP SP2
Using XAMPP Windows 1.6.3a (could this be the problem)

#143

August 21st, 2007, 02:47 AM

blaqb0x

Join Date: Mar 2004

Posts: 87

Time spent in forums: 12 h 16 m 20 sec
Reputation Power: 13

Ldapsearch for AD disabled accounts

does anyone know the ldapsearch command to search for disabled accounts in active directory?

Thanks.

#144

August 21st, 2007, 05:28 AM

jules95540

Registered User

Join Date: Aug 2007

Posts: 1

Time spent in forums: 25 m 56 sec
Reputation Power: 0

HELP ME (Add: Constraint violation)

I'm connect to the Active directory server (Windows 2000), and after I bind with the admin account, I can show all users...etc.
And when I want to add an user, the page return this :
Warning: ldap_add() [function.ldap-add]: Add: Constraint violation in /home/intranet/form_test/test.php on line 92

This is my code :

PHP Code:


		
			
<?



$ldaprdn  = 'ADMIN@DOMAINE.com'; // DN ou RDN LDAP

$ldappass = 'GOOD_PASS'; // Mot de passe



$ds = ldap_connect ("SERVEUR_AD");



ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3); 



if ($ds)

{

    ldap_bind ($ds, $ldaprdn, $ldappass);

    

    $sr = ldap_search ($ds, "OU=Users,OU=101,DC=DOMAINE,DC=com", "(CN=*)");

    $info = ldap_get_entries ($ds, $sr);

    

    echo "<pre>";

    print_r($info[1]); // It's work

    echo "</pre><br>";

    

    $adduserAD["cn"][0] = "UNew";

    $adduserAD["instancetype"][0] = '4';

    $adduserAD["samaccountname"][0] = "UNew";

    $adduserAD["objectclass"][0] = "top";

    $adduserAD["objectclass"][1] = "person";

    $adduserAD["objectclass"][2] = "organizationalPerson";

    $adduserAD["objectclass"][3] = "user";

    $adduserAD["displayname"][0] = "USER New";

    $adduserAD["name"][0] = "USER";

    $adduserAD["givenname"][0] = "New";

    $adduserAD["sn"][0] = "USER";

    $adduserAD["company"][0] = "Comp";

    $adduserAD["department"][0] = "Dept1";

    $adduserAD["mail"][0] = "user@comp.com";

    $adduserAD["initials"][0] = "UN";

    $adduserAD["samaccountname"][0] = "UNew";

    $adduserAD["userprincipalname"][0] = 'UNew@DOMAINE.COM';

    //$adduserAD["manager"][0] = "GHuet";

    

    if (!ldap_add($ds, "CN=UNew,OU=Achats,OU=Users,OU=101,DC=DOMAINE,DC=com", $adduserAD)) // Don't work

    {

         echo "There is a problem to create the account";

    }

}

ldap_close($ds);



?>

Help me please !

THX all and good luck.

#145

August 26th, 2007, 08:58 PM

chrisg75

Registered User

Join Date: Aug 2007

Posts: 2

Time spent in forums: 17 m 4 sec
Reputation Power: 0

thanks to all of you I have found how to modificate datas in my AD.

First of all I had to connect through SSL.

Whithout SSL I can search my users whereever he is (we have a lot of personalised Organisational Units). For that I use basedn = "" and connect to the port 3268 .

But in SSL I cannot use an empty basedn, even if I use 3269 instead of 646.

My big problem is that I can only find users if they are in the Users "folder" instead of one of our OU.

Do you know how to search in the whole active directory with SSL ? I've been looking for that on the internet for days !

#146

August 26th, 2007, 09:04 PM

chrisg75

Registered User

Join Date: Aug 2007

Posts: 2

Time spent in forums: 17 m 4 sec
Reputation Power: 0

Quote:

Originally Posted by jules95540

Warning: ldap_add() [function.ldap-add]: Add: Constraint violation in /home/intranet/form_test/test.php on line 92

PHP Code:


		
			
<?

    $adduserAD["cn"][0] = "UNew";

    $adduserAD["instancetype"][0] = '4';

    $adduserAD["samaccountname"][0] = "UNew";

    $adduserAD["objectclass"][0] = "top";

    $adduserAD["objectclass"][1] = "person";

    $adduserAD["objectclass"][2] = "organizationalPerson";

    $adduserAD["objectclass"][3] = "user";

    $adduserAD["displayname"][0] = "USER New";

    $adduserAD["name"][0] = "USER";

    $adduserAD["givenname"][0] = "New";

    $adduserAD["sn"][0] = "USER";

    $adduserAD["company"][0] = "Comp";

    $adduserAD["department"][0] = "Dept1";

    $adduserAD["mail"][0] = "user@comp.com";

    $adduserAD["initials"][0] = "UN";

    $adduserAD["samaccountname"][0] = "UNew";

    $adduserAD["userprincipalname"][0] = 

?>

I had this very same error when one of the lines was not correct. I had written $adduserAD["location"] instead of $adduserAD["physicaldeliveryofficename"], you should try to comment the lines one by one...

#147

October 16th, 2007, 04:38 AM

PHP_CLI

Registered User

Join Date: Oct 2007

Posts: 1

Time spent in forums: 22 m 24 sec
Reputation Power: 0

This works for me!

First of all i have two seperate servers for this setup.
One AD-controller and one webserver

My webserver is running Ubuntu and apache, i have used this on IIS and that works too!

First of all i have a setup an stunnel between the AD box and the webserver box (stunnel dot org)

Here is my PHP code:

PHP Code:


		
			
<?php





###########################################

####################################       #

###################################  AD&PHP #

####################################       #

###########################################



$AD_server = "localhost:390";

$AD_Auth_User = "user_with_rights@mydomain.com";

$AD_Auth_PWD = "uX42pku";

$AD_dn = 'OU=users,OU=somwhere,DC=my,DC=domain,DC=com';

$uid = 'Test98765'; #User to change password for

$pwdtxt = 'Tetra75*'; #The password in cleantext



$protocolVersion = 3;



$ldap = ldap_connect($AD_server);

if (!ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, $protocolVersion)) {

    exit('Failed to set protocol version to '.$protocolVersion);

}

ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);  

// bind anonymously so that we can verify if the server really is running

ldap_bind($ldap);

if (ldap_errno($ldap) !== 0) {

    exit('Could not connect to LDAP server');

}



// now bind with the correct username and password

ldap_bind($ldap, $AD_Auth_User,$AD_Auth_PWD);

if (ldap_errno($ldap) !== 0) {

    exit('ERROR: '.ldap_error($ldap));

}



$searchResults = ldap_search($ldap, $AD_dn, 'cn=*'.$uid.'*');

// no matching records

if ($searchResults === false){

    exit('No user found');

}



if (!is_resource($searchResults)){

    exit('Error in search results.');

}



// create the unicode password



$newPassword = "\"" . $pwdtxt . "\"";

$len = strlen($newPassword);

$newPassw = "";



for($i=0;$i<$len;$i++) {

    $newPassw .= "{$newPassword{$i}}\000";

}



$info["unicodepwd"] = $newPassw;



$entry = ldap_first_entry($ldap, $searchResults);

if (!is_resource($entry)){

    exit('Couldn\'t get entry');

}

$userDn = ldap_get_dn($ldap, $entry);



ldap_modify($ldap, $userDn, $info); 





<