Page 9 - Modifying Active Directory passwords through PHP and IIS

<?PHP 
/*** Variable Settings ***/ 
$uid = 'uid'; 
$userbindDN = 'userbind'; 
//existing password 
$userbindPass = 'password'; 
// new password 
$passwd1 = 'changeme'; 
$passwd2 = 'changeme'; 
// administrative bind user 
$authbindDN = 'authbind'; 
$authbindPass = 'authpass'; 
// ldap server info 
$ldapserver = '123.123.123.123'; 
$baseDN = 'DC=me,DC=com'; 
/**************************/ 

/************* Main Script Code ***************/ 
/**  Connect SSL to Ldap Server **/ 
echo "Connecting SSL to server<br>"; 
$ldap = ldap_connect($ldapserver); 
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3); 
ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0); 
/**  Test connection by using anonymous bind **/ 
echo "Testing anonymous bind to server<br>"; 
ldap_bind($ldap); 
if (ldap_errno($ldap) !== 0) 
{ 
    exit('Could not connect to LDAP server - '.ldap_error($ldap)); 
} 
/**  Now try to bind with the username and password **/ 
echo "Now binding using user info<br>"; 
ldap_bind($ldap, $userbindDN, $userbindPass); 
if (ldap_errno($ldap) !== 0) 
{ 
    exit('ERROR: User ID/Password Invalid - '.ldap_error($ldap)); 
} 
/**  We got this far, let's bind with an admin user **/ 
echo "Now binding using admin info<br>"; 
ldap_bind($ldap, $authbindDN, $authbindPass); 
if (ldap_errno($ldap) !== 0) 
{ 
     exit('ERROR: Unable to bind with admin user info - '.ldap_error($ldap)); 
} 
$searchResults = ldap_search($ldap, $baseDN, 'CN='.$uid); 
// no matching records 
$info = ldap_get_entries($ldap, $searchResults); 
if ($searchResults === false) 
{ 
  exit('User ($uid) not found in AD'); 
} 
if (!is_resource($searchResults)) 
{ 
  exit('Error in search results.'); 
} 
$entry = ldap_first_entry($ldap, $searchResults); 
if (!is_resource($entry)) 
{ 
    exit('Couldn\'t get entry'); 
} 
$userDn = ldap_get_dn($ldap, $entry); 
// Check Pwds not really used in this script but... 
if ($passwd1 == $passwd2){ 
    // prepare data 
    $newPassword = $passwd1; 
    $newPassword = "\"" . $newPassword . "\""; 
    $len = strlen($newPassword); 
    for($i = 0; $i < $len; $i++) 
  { 
        $newPassw = "{$newPassword{$i}}\000"; 
  } 
    $newPassword = $newPassw; 
    $userdata['unicodePwd'] = $newPassword; 

  echo "<------------ Changing Password --------------><br><br>"; 
  echo "Username = ".$uid."<br>"; 
  echo "User login ID = ".$userbindDN."<br>"; 
  echo "User DN = $userDn<br>"; 
  $result = ldap_mod_replace($ldap, $userDn , $userdata); 
    if($result) 
  { 
       echo "User modified!<br>" ; 
    }else{ 
       echo "There was a problem!<br>"; 
       echo ldap_error($ldap)."<br>"; 
  } 
    /**  Now try to bind with the username and new password to insure change**/ 
    echo "Now testing new password to insure change<br>"; 
    ldap_bind($ldap, $userbindDN, $passwd1); 
    if (ldap_errno($ldap) !== 0) 
    { 
        exit('ERROR: User ID/Password Invalid - '.ldap_error($ldap)); 
    }else{ 
        echo "Password Verified OK. Password change complete<br>"; 
    } 
} 
?>