note 124058 rejected from function.ldap-modify-batch by cmb
| From: | cmb@php.net | Date: | Mon, 22 Jul 2019 16:15:08 +0000 |
| Subject: | note 124058 rejected from function.ldap-modify-batch by cmb | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-211674@lists.php.net to get a copy of this message | ||
Note Submitter: shintoz at yahoo dot com
----
Example #6 Change a user's password (Active Directory) (Correction)
In a properly configured Active Directory Environment (i.e. you cannot have blank passwords), the
ldap_modify_batch example (#5) is incorrect and will fail with a constraint violation error.
The correct way to batch modify a user password for Active Directory (tested on a Windows 2012R2
Forest/Domain) would be:
<?php
function adifyPw($pw)
{
return iconv("UTF-8", "UTF-16LE", '"' . $pw .
'"');
}
$dn = "cn=Jack Smith-Jones,ou=Wizards,dc=ad,dc=example,dc=com";
$modifs = [
[
"attrib" => "unicodePwd",
"modtype" => LDAP_MODIFY_BATCH_REPLACE,
"values" => [adifyPw("correct horse battery staple")],
],
];
ldap_modify_batch($connection, $dn, $modifs);
?>
This is because a batch remove violates the "no blank passwords" constraint.