What are the bare minimum rights you need to change an other persons LDAP password?. I'm working on a tool that allows a user to change his password. as the tool needs to be written in PHP the only problem is that you can't use a user account to change the password. to work around this we want to use an manger/admin account that can only change the passwords of all the other users.

now the problem. we could not find the right rights to set so that the account was allowed to change the passwords. the only way it worked for us was if we made him domain-admin and that is something we don't want. So what are the minimum rights that some one needs to change a other person password with PHP?

EDIT: Changed the title to fit the question better.

  • Are you looking to reset the password of the user, where the user does not provide you with their original password (and they provide something else, like answers to security questions)? Or are you looking to change the password when you have both the original and the new password? The privilege requirements for these two options are very different. – Shane Madden May 31 '12 at 3:17
  • It's closer to the first. the problem with PHP and an AD LDAP is that there is no support in the LDAP API for PHP the allow the user to change his password by suppling a old password and a new one. so the only way is to use an other account that has the privlage the change a password without suppling the old one. – Luuky19 May 31 '12 at 6:43

Apache has a suexec module, which allows the spawning of threads as separate users, but I don't think that's the simplest solution.

Instead, why not just login to the ldap server as the user, using the user's password and the user's new password at the same time. You should be able to just use ldappasswd (or the PHP equivalent) to do this.

The man page for ldappasswd and a google search for "php ldappasswd" should find you everything you're looking for.

EDIT: LDAP servers have only one administrative user AFAIK, the root_dn, which can modify everything, including other user's passwords. I imagine you don't have the root_dn's login details though, unless you manage the ldap server yourself.

| improve this answer | |
  • PHP does not support that way of changing the password of a user. the only way is to use an account that has the right to do that, but we can't find the minimum rights to do this. using an domain admin account is not what we want do to sec reasons, like some one downloading the PHP page and have an admin to log on the system with. – Luuky19 May 31 '12 at 6:48
  • but I might be able to use system() to use the Linux server to change the PW. – Luuky19 May 31 '12 at 6:59
  • Have you looked at the schema information for Domain Admins? There's probably privilege declarations in there which you could use as a template for designing your own ldap schema. That should do what you want, but "it's not for the faint hearted" – Alex Leach May 31 '12 at 10:42

To change the attribute containing the password, the connection that intends to issue the modify request must have an authorization identity with sufficient access rights to change the password, or by using the proxied authentication mechanism, in which case access rights must still be sufficient.

| improve this answer | |
  • but what are the sufficient rights? thats my question. – Luuky19 May 31 '12 at 6:45

There's some good information available about the constraints on the unicodePwd attribute here. There are two methods by which you can alter the attribute; a change operation (which requires a delete of the old password then an add of the new password in the same modify operation) and a reset operation (which uses a replace operation, and requires the user you've bound as to have the right permissions).

That's a little bit awful that the PHP LDAP module can't do multiple operations in one transaction. So, you are stuck with doing a reset operation; keep in mind that exposing a password change interface implemented through this method will allow the users to bypass requirements that they actually change their password (they can reset it to the same one) as well as requirements that they not use a previously used password (history enforcement is not checked).

The permission required for your administrative account to perform the reset operation against a user account is the "Reset Password" permission:


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.