python-ldap-dev

Change password

[Jonathan H. <jon...@23...>]

Does anyone have a working password change script for active directory  
server that will run on Linux? We try and run as little as possible on  
windows.

I have found several but none actually run. I know I am committing  
list pho pa by asking this but I am an IT guy not a programmer so  
although am working on it do not yet have the skill to sort out stuff  
like this.

My attempt at a script authenticated fine but then when I tried to do  
a search or anything else claimed it was not able to talk to the  
server it had just authenticated against *sighs* I hate microsoft.

Thanks,

Jonathan

PS: my error in case anyone wants to help with that instead:

=> result: (97, [], 1, [])
Bind result: (97, [])
Running search: (objectClass=user)(mail=*)
*** ldap://my.ldap.server:389 - SimpleLDAPObject.search_ext  
(('cn=Users,my.dc', 2, '(objectClass=user)(mail=*)', ['*'], 0, None,  
None, -1, 0),{})
=> result: 2
*** ldap://my.ldap.server:389 - SimpleLDAPObject.result3 ((2, 1, -1),{})
=> LDAPError - SERVER_DOWN: {'info': '', 'desc': "Can't contact LDAP  
server"}
Can't contact LDAP server

Re: Change password

[Michael S. <mi...@st...>]

Jonathan Hansen wrote:
> Does anyone have a working password change script for active directory  
> server that will run on Linux?

My web2ldap implements it. But it's not a small script. Depending on
your use-case you might consider deploying web2ldap though. At least for
learning how the data looks like it would be useful.

I see three issues here:

> *** ldap://my.ldap.server:389 - SimpleLDAPObject.search_ext  
> (('cn=Users,my.dc', 2, '(objectClass=user)(mail=*)', ['*'], 0, None,  
              ^^^^^
1. This is not a valid DN. With AD it should rather look like

cn=Users,dc=my,dc=domain

> *** ldap://my.ldap.server:389 - SimpleLDAPObject.result3 ((2, 1, -1),{})
> => LDAPError - SERVER_DOWN: {'info': '', 'desc': "Can't contact LDAP  
> server"}

2. This error code means the LDAP server wasn't reachable at all.

3. Also note that for chaning the AD password (attribute unicodePwd) you
have to use SSL. So your connection URI has to look like this:

ldaps://my.ldap.server:636

See Demo/initialize.py how to set the SSL/TLS-related options.

Ciao, Michael.