samba - Apr 2014 - Changing active directory user password via LDAP

Hello, lists.

I'm struggling to find out, how one can change password of an active
directory (based on samba4) user via LDAP.

The problem is that if I try to use userPassword parameter:

dn: CN=John Smith,cn=Users,DC=domain,DC=com
changetype: modify
replace: userPassword
userPassword: newPassword

ldapmodify -v -c -a -f filename.ldif -H ldaps://server.domain.com -D\
administrator at domain.com -W \
ldap_initialize( ldaps://server.domain.com:636/??base )

Enter LDAP Password: 
replace userPassword:
        newPassword
modifying entry "CN=John Smith,cn=Users,DC=domain,DC=com"
modify complete

This seems to work, but does not affect user in any matter. As far as I
managed to find out, is that userPassword is not native Active Directory
attribute.
You must use unicodePwd attribute instead.
But then I get to another problem:


dn: CN=John Smith,cn=Users,DC=domain,DC=com
changetype: modify
replace: unicodePwd
unicodePwd: newPassword

ldapmodify -v -c -a -f filename.ldif -H\ ldaps://server.domain.com -D\
administrator at domain.com -W 
ldap_initialize( ldaps://server.domain.com:636/??base )
Enter LDAP Password: 
replace unicodePwd:
        newPassword
modifying entry "CN=John Smith,cn=Users,DC=domain,DC=com"
ldap_modify: Server is unwilling to perform (53)
        additional info: 00002035: setup_io: it's not allowed to set the
NT hash password directly'

It seems, that samba4 does not allow to change this attribute directly.
So the question would be: is it possible to change AD user password via
LDAP, or this can only be done via samba tools and windows client?

Thank you.
--

Try this:
https://code.google.com/p/ad-change-pass/

It worked for us.

----- Mensaje original -----
De: "Tadas" <tadas at ring.lt>
Para: samba at lists.samba.org
Enviados: Mi?rcoles, 30 de Abril 2014 13:33:46
Asunto: [Samba] Changing active directory user password via LDAP

Hello, lists.

I'm struggling to find out, how one can change password of an active
directory (based on samba4) user via LDAP.

The problem is that if I try to use userPassword parameter:

dn: CN=John Smith,cn=Users,DC=domain,DC=com
changetype: modify
replace: userPassword
userPassword: newPassword

ldapmodify -v -c -a -f filename.ldif -H ldaps://server.domain.com -D\
administrator at domain.com -W \
ldap_initialize( ldaps://server.domain.com:636/??base )

Enter LDAP Password: 
replace userPassword:
        newPassword
modifying entry "CN=John Smith,cn=Users,DC=domain,DC=com"
modify complete

This seems to work, but does not affect user in any matter. As far as I
managed to find out, is that userPassword is not native Active Directory
attribute.
You must use unicodePwd attribute instead.
But then I get to another problem:


dn: CN=John Smith,cn=Users,DC=domain,DC=com
changetype: modify
replace: unicodePwd
unicodePwd: newPassword

ldapmodify -v -c -a -f filename.ldif -H\ ldaps://server.domain.com -D\
administrator at domain.com -W 
ldap_initialize( ldaps://server.domain.com:636/??base )
Enter LDAP Password: 
replace unicodePwd:
        newPassword
modifying entry "CN=John Smith,cn=Users,DC=domain,DC=com"
ldap_modify: Server is unwilling to perform (53)
        additional info: 00002035: setup_io: it's not allowed to set the
NT hash password directly'

It seems, that samba4 does not allow to change this attribute directly.
So the question would be: is it possible to change AD user password via
LDAP, or this can only be done via samba tools and windows client?

Thank you.
-- 




-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

On Wed, 2014-04-30 at 14:33 +0300, Tadas wrote:
> Hello, lists.
> 
> I'm struggling to find out, how one can change password of an active
> directory (based on samba4) user via LDAP.
> 
> The problem is that if I try to use userPassword parameter:
> 
> dn: CN=John Smith,cn=Users,DC=domain,DC=com
> changetype: modify
> replace: userPassword
> userPassword: newPassword
> 
> ldapmodify -v -c -a -f filename.ldif -H ldaps://server.domain.com -D\
> administrator at domain.com -W \
> ldap_initialize( ldaps://server.domain.com:636/??base )
> 
> Enter LDAP Password: 
> replace userPassword:
>         newPassword
> modifying entry "CN=John Smith,cn=Users,DC=domain,DC=com"
> modify complete
> 
> This seems to work, but does not affect user in any matter. As far as I
> managed to find out, is that userPassword is not native Active Directory
> attribute.
> You must use unicodePwd attribute instead.
> But then I get to another problem:
> 
> 
> dn: CN=John Smith,cn=Users,DC=domain,DC=com
> changetype: modify
> replace: unicodePwd
> unicodePwd: newPassword
> 
> ldapmodify -v -c -a -f filename.ldif -H\ ldaps://server.domain.com -D\
> administrator at domain.com -W 
> ldap_initialize( ldaps://server.domain.com:636/??base )
> Enter LDAP Password: 
> replace unicodePwd:
>         newPassword
> modifying entry "CN=John Smith,cn=Users,DC=domain,DC=com"
> ldap_modify: Server is unwilling to perform (53)
>         additional info: 00002035: setup_io: it's not allowed to set
the
> NT hash password directly'
> 
> It seems, that samba4 does not allow to change this attribute directly.
> So the question would be: is it possible to change AD user password via
> LDAP, or this can only be done via samba tools and windows client?
unicodePwd has to be set as a UTF-16 string surrounded by a UTF-16
" (yes really!) value on each side.  

Andrew Bartlett

-- 
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba