Changing (not resetting) a users password using PHP LDAP - php

Question

I'm trying to change a users password inside an Microsoft active directory using php-ldap. The problem is when trying to change the password with ldap_mod_replace it's not changing but resetting the password and that's not what I want, because my users are not permitted to reset their own password.
The active directory is based on a Microsoft server 2016, my application is running on an IIS webserver using PHP 7.2.
// open LDAP connection
$ldap_connection = $this->connectToActiveDirectory();
if (#ldap_bind($ldap_connection, $this->ldap_username . '#' . env('LDAP_DOMAIN', 'localhost'), $request->oldPassword)) {
// LDAP connection established
$dn = $request->userdn; // distinguished name of user
/*
The DC requires that the password value be specified in a UTF-16 encoded Unicode
string containing the password surrounded by quotation marks, which has been BER-encoded
as an octet string per the Object(Replica-Link) syntax.
*/
$newPassword = "\"" .$request->password. "\"";
$utf16Password = ""; // converted password
$passwordLength = strlen($newPassword);
for ($i = 0; $i < $passwordLength; $i++) {
$utf16Password .= "{$newPassword{$i}}\000";
}
$passwordEntry = array('unicodePwd' => $utf16Password);
// Set new password
if(#ldap_mod_replace($ldap_connection, $dn, $passwordEntry)) {
// Successful
} else {
// Error, probably not enough permissions
return back(); // Redirect user to previous page
}
ldap_unbind($ldap_connection); // Close LDAP connection
return redirect('/logout'); // Redirect user to logout
}
I want to change the password and not reset it, and I can't find a solution. Maybe some of you have experienced this problem, I'm thankful for any help!

Answer 1

According to the documentation for the unicodePwd attribute, this is how you do it:
If the Modify request contains a delete operation containing a value Vdel for unicodePwd followed by an add operation containing a value Vadd for unicodePwd, the server considers the request to be a request to change the password. ... Vdel is the old password, while Vadd is the new password.
In short, you need to delete the value and add the value in one LDAP request. In PHP, that means using the ldap_modify_batch function. In fact, in that documentation, there is an example of how to change a password:
<?php
function adifyPw($pw)
{
return iconv("UTF-8", "UTF-16LE", '"' . $pw . '"');
}
$dn = "cn=Jack Smith-Jones,ou=Wizards,dc=ad,dc=example,dc=com";
$modifs = [
[
"attrib" => "unicodePwd",
"modtype" => LDAP_MODIFY_BATCH_REMOVE,
"values" => [adifyPw("Tr0ub4dor&3")],
],
[
"attrib" => "unicodePwd",
"modtype" => LDAP_MODIFY_BATCH_ADD,
"values" => [adifyPw("correct horse battery staple")],
],
];
ldap_modify_batch($connection, $dn, $modifs);