PHP LDAP change password page

Posted by Radek in IT stuff on 09 2nd, 2009

I have recently implemented an SSO (Single Sign On) mechanism in one of my places and then I started to look for a simple quick-and-dirty way to allow the users to change their passwords via PHP.

I have found many complicated examples but I thought, come on, this is really one page I am looking for. So, I have written my own and now I am   sharing it with you.

The page has only two variables at the beginning, letting you set the LDAP server hostname and the binding DN. The script behaves like this:

  1. It connects to ldap via anonymous binding.
  2. Searches for the user specified in the username field by doing a search on the uid= part of DN for any object matching the username.
  3. The found object (if only 1)  is returned to get a full DN with real CommonName.
  4. PHP re-binds as the user using the “current” user password.
  5. New password is being hashed and ldap_modify is called on the DN.
  6. Optionally a confirmation email is sent to the address from mail attribute.

You will have to customize for your needs obviously but it is as simple as modyfying one function. Just for curiosity, write a comment if you have used it for your site in any way.

20 Responses to “PHP LDAP change password page”

  • Nacho, on September 16th, 2009 at 01:09:27 Said:

    Thanks! :)

  • TGM, on September 24th, 2009 at 03:09:26 Said:

    That’s really great. Much better than most of the complex tools I found on web. What I wished, was just to have a simple interface for our users to change their ldap password for web access.

    Thanks a lot.

  • biji, on September 30th, 2009 at 04:09:39 Said:

    thanks a lot…

  • Bryan, on November 14th, 2009 at 02:11:52 Said:

    Dude, this script rocks. I was search all over the web for this type of script and came across this one. Have to say I am not well versed in PHP, but it was easy to install and get working. Does exactly what I need.

    Thanks a lot for writing it.
    Bryan

  • Bryan, on November 14th, 2009 at 02:11:32 Said:

    One little thing, there are two references to $server, which was not defined. I changed them to the $ldap, and it worked.

    You might want to change that in your code.

  • alfach, on December 14th, 2009 at 05:12:27 Said:

    cool, it works

    thanks a lot

  • bushdoctor, on January 22nd, 2010 at 05:01:30 Said:

    Thanks for the script Radek.

    Do you need any specific settings in the slapd.conf to allow user changes of passwords? I can get as far as “E200 – Your password cannot be changed” but unfortunately can’t get the passwords to change.

  • Radek, on January 25th, 2010 at 12:01:37 Said:

    Hi

    You just need a standard access to the user’s attributes by the user, this is a standard openldap ACL:

    access to attrs=userPassword,shadowLastChange
    by anonymous auth
    by self write
    by * none

    access to dn.base=”" by * read

    access to *
    by * read

  • Michael, on January 29th, 2010 at 11:01:10 Said:

    thanks a lot but in the 1 line its :

    $server = “localhost”

    but in function you write :

    changePassword($ldap,$dn,$_POST["username"],$_POST["oldPassword"],$_POST["newPassword1"],$_POST["newPassword2"]);

    but something like $ldap is not exist, probably you think about $server, so should be:

    changePassword($server,$dn,$_POST["username"],$_POST["oldPassword"],$_POST["newPassword1"],$_POST["newPassword2"]);

    and its working for me;

    best wishes, Michael;

  • Radek, on January 29th, 2010 at 11:01:15 Said:

    Sure, thanks for that :)
    Fixed.

  • Christene, on February 12th, 2010 at 08:02:00 Said:

    Thank you thank you so much! I have been at my wits end trying to do this. I ended up at a dead end a year ago. My nemesis project just got pushed back to the top of my list and your script is just what I need to get started! Your script just taught me more about interacting with LDAP via php than anything else I’ve read or samples I’ve tried to dissect. I normally work with jsp and this is just about impossible to do with that! Thanks again.

  • Eduardo Silva, on February 17th, 2010 at 10:02:24 Said:

    Thank you very much for this script.
    I was looking for this for a long time!
    :)

  • Ajowi, on February 18th, 2010 at 03:02:54 Said:

    Thanks!
    Works for me.

  • ELMtree, on February 19th, 2010 at 06:02:39 Said:

    Thanks for the great script. Suits my needs perfectly and even looks clean and professional!

  • Head, on March 11th, 2010 at 09:03:16 Said:

    good work.
    but i dont understand this line:

    $rdn = sprintf($dn,$_POST["username"]);

    and i think you have to filter the post values like:

    if (!get_magic_quotes_gpc()) {
    $username = addslashes($_POST['username']);
    $oldPassword = addslashes($_POST['oldPassword']);
    $newPassword1 = addslashes($_POST['newPassword1']);
    $newPassword2 = addslashes($_POST['newPassword2']);
    } else {
    $username = $_POST['username'];
    $oldPassword = $_POST['oldPassword'];
    $newPassword1 = $_POST['newPassword1'];
    $newPassword2 = $_POST['newPassword2'];
    }

    and then use:

    changePassword($server,$dn,$username,$oldPassword,$newPassword1,$newPassword2);

  • Veera, on March 24th, 2010 at 02:03:30 Said:

    Thanks for the script. Great work.
    I was looking this script all over. You made my life easy. Thanks a ton!!!!

  • Sontaya, on April 19th, 2010 at 10:04:11 Said:

    Thank you for shared. Your script it worked.
    I try already (SUSE Linux)

    Thanks,
    Sontaya
    http://blog.susethailand.com

  • Daniel Lin, on May 17th, 2010 at 12:05:10 Said:

    It works with CentOS Directory Server 8.1.
    Thanks for your effort.Very Good !!!^^

  • Ducn, on July 2nd, 2010 at 04:07:46 Said:

    Hi Radek.

    I’ve been trying around but it didn’t work for me.
    do I need any further configuration ?
    I’m using windows XP running:
    Appache 2.2.8 for windows
    PHP ver 6.
    Windows Server 2003 ent – with LDAPS support.

    you script keep saying :Found user

    E200 – Your password cannot be change, please contact the administrator.
    (note that: I am able to connect to LDAPS via port 635 already, and the user already exist on AD) .

    Thank you !!

  • Davie, on July 22nd, 2010 at 12:07:58 Said:

    I added the line:

    ldap_start_tls($con);

    So that I have TLS enabled. Works flawlessly, but could use some minor spellchecking. Exactly what I was looking for otherwise! :-D

Leave a Reply