how to add an Active directory authenfication password with PHP? - php

Question

I come to you because I have a little problem with an Active directory server, indeed I can connect to get my users ... when I add a user with the AD software, I assign him a password and this one is enabled for authentication in PHP with a form, nothing abnormal.
The problem is that when I add a user directly with PHP I use this code
$ldapconn=ldap_connect("adress");
$ldapbind=ldap_bind($ldapconn, "local", "test");
$cn = $info["cn"][0] = "test test ";
$info["sn"][0] ="test ";
$info["givenname"][0] ="test ";
$info["displayname"][0] ="test test ";
$info["name"][0] ="test test ";
$info["userprincipalname"][0] = "test #test .test ";
$info["samaccountname"][0] = "ttest ";
$info["objectClass"][0]="top";
$info["objectClass"][1]="person";
$info["objectClass"][2]="organizationalPerson";
$info["objectClass"][3]="user";
$info["objectCategory"][0] ="CN=Person,CN=Schema,CN=Configuration,DC=test
,DC=test ";
$info['userPassword'][0] = "test ";
// add entries
$r = ldap_add($ldapconn,"CN=".$cn.",OU=Utilisateurs,DC=test ,DC=test ", $info);
My user is correctly added but php authentication is not done, my user doesn't have an authentication password but a password that should be used for something else, I read on the net that $info['userPassword'] allows to create a password that is not usable for authentication. Someone would have the exact attribute in order to create this password please.
Thank you in advance for your help.
I also tried with the attribute $info['unicodePwd'] but I get an error message
" Add: Server is unwilling to perform ".

Answer 1

The userPassword attribute sometimes works, but the unicodePwd is the real attribute.
There are a couple caveats:
You have to be connected to AD via an encrypted connection. That means LDAP over SSL (LDAPS). So in your call to ldap_connect, you need to use ldaps://example.com. This can open a can of worms since the SSL certificate sent by the server needs to be trusted by your app. There are some comments on the documentation page that can help there.
The format of the value you assigned to unicodePwd must be:
specified in a UTF-16 encoded Unicode string containing the password surrounded by quotation marks, which has been BER-encoded as an octet string per the Object(Replica-Link) syntax.
There is also an example of this on the documentation page for ldap-mod-replace:
$newPassword = "MyPassword";
$newPassword = "\"" . $newPassword . "\"";
$len = strlen($newPassword);
for ($i = 0; $i < $len; $i++)
$newPassw .= "{$newPassword{$i}}\000";
$newPassword = $newPassw;
$userdata["unicodepwd"] = $newPassword;
$result = ldap_mod_replace($ad, $userDn, $userdata);
if ($result) echo "User modified!" ;
else echo "There was a problem!";
You may have to use ldap_mod_replace to set the password after creating the account first (rather than using $info['unicodepwd'][0] while creating the account). In my experience, I've always had to create the account first, then set the password.
But because of having no password at first, accounts are usually disabled (depending on your policies). So you will likely have to set the userAccountControl attribute to 512 (NORMAL_ACCOUNT) to enable it after you've set the password.

Answer 2

Thanks to you for your answer, I tried with your solution by not putting the'[unicodepwd]' and using "ldap_mod_replace" afterwards but I get an error message "server is unwilling to perform".
I think my server is configured in a specific way.
I found another solution, I use the "Adldap2" tool ( https://adldap2.github.io/Adldap2/#/?id=what-is-adldap2), which contains all the functions necessary to use LDAP with PHP.
I recommend it to anyone who has difficulties with Active directory .
For example, my problem was solved with this code:
enter code include __DIR__ . '/vendor/autoload.php';
$config = [
// Mandatory Configuration Options
'hosts' => ['testServer'],
'base_dn' => 'dc=test,dc=test',
'username' => 'test#test.test',
'password' => 'test',
'account_suffix' => '#test.test',
'port' => 636,
'use_ssl' => true,
];
$ad = new Adldap\Adldap();
$connectionName = 'my-connection';
$ad->addProvider($config, $connectionName);
try {
$provider = $ad->connect($connectionName);
echo"Connection ok <br>" ;
// Great, we're connected!
} catch (Adldap\Auth\BindException $e) {
// Failed to connect.
echo"Connection failed<br>" ;
}
$user = $provider->make()->user([
'cn' => 'test test ',
'userprincipalname' => 'test#test.test',
'accountExpires'=> 132188680854770000
]);
$user->setDn("CN=test tes ,OU=test ,DC=test,DC=test");
$dn = $user->getDn();
$user->setDisplayName('test test ');
$user->setAccountName('ttest');
$user->setFirstName('test');
$user->setLastName('test');
$attribut = $user->getAttributes();
var_dump($attribut);
$user->setEmail('test#test.test');
// Save the new user.
// Enable the new user (using user account control).
if ($user->save()) {
// Enable the new user (using user account control).
$user->setUserAccountControl(66048);
// Set new user password
$user->setPassword('test');
// Save the user.
if($user->save()) {
// The password was saved successfully.
}
}
hope this can helps :)