Change AD password using PHP [closed]

Question

I am trying to access my ad server(for entry/User modification) remotely, I got connection using port 389 with my public IP but it doesn't let me to make modification in entry(able to retrieve entry). So, I try to make connection using port 636 but I am not able to connect using this port. So, can you please let me know what changes do I need to make to connect on 636 or How can I modify Entry(i.e change password(unicodepwd)) on port 389?

Thanks in Advance.!

Answer 1

Using PHP, you can change an AD user password using LDAP with a simple bind on an SSL connexion.

For this you need to install a certificate on you AD server. The simple way (not the more attractive) is to install Microsoft Certificate Server on your domain (Enterprise installation see Configuring Microsoft Active Directory for SSL Access) and then to reboot your domain controler. You can also generate a certificate with OpenSSL and install it on the computer (see How to enable LDAP over SSL with a third-party certification authority).

Here is a sample of an LDIF File that allow to create a user with his password on an SSL connexion, you will find the way I generate the base 64 string for the password :

# Imported with :
# ldifde -i -t 636 -f .\Annuaire3.ldf
# Password generated by ("" must be encoded inside):
# stringconverter.exe \"test.2011\" /unicode /encode
# Connexion then tested with :
# runas /user:jdupont cmd.exe (password is test.2011)

dn: cn=Jean Dupont,OU=MonOU,DC=societe0,DC=fr
changetype: add
objectClass: user
objectClass: organizationalPerson
objectClass: person
objectClass: top
cn: Jean Dupont
givenName: Jean
sn: Dupont
mail: [e-mail]
telephoneNumber: 9999
userAccountControl: 544
sAMaccountName: jdupont
userPrincipalName: [e-mail]
unicodePwd:: IgB0AGUAcwB0AC4AMgAwADEAMQAiAA==