Ошибка ldap при смене пароля

I currently try to change passwords in our Active Directory Envoirenment via LDAP on Linux since the users in question do not have access to a windows-machine and we want to keep it that way.
In order to change the password I am currently stuck figuring out how to use ldapmodify to do so. After a lot of reading on different sites/forums/newsgroups I am much more confused than before

However:
I try the following command to do so:

ldapmodify -f ldif.example -H ldaps://lab01-dc01.example.com -D 'CN=test,CN=users,DC=lab01,DC=example,DC=com' -x -W

The contents of the ldif.example:

dn: CN=test,CN=Users,DC=lab01,DC=example,DC=com
changetype: modify
delete: unicodePwd
unicodePwd:: V3VQdXV1STEyLg==
-
add: unicodePwd
unicodePwd:: QmxhVVVraTEyLg==
-

(Don’t worry — those passwords are not used anywhere and it is not a production envoirenment)

Now — every time I execute the command I get the following error:

modifying entry CN=test,CN=Users,DC=lab01,DC=example,DC=com"
ldapmodify: Constraint violation (19)
 additional info: 0000216C: AtrErr: DSID-03190EB0, #1:
 0: 0000216C: DSID-03190EB0, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 9005a (unicodePwd)

Now, after what I read the reason for this error is either that the password is badly formatted or that the password policy doesn’t allow the password I used. I checked the policy — multiple times now — and the new password definetly complies to the policy by all the criteria. If I set the password using a Windows-machine it also works well (of course I changed the «oldpassword» and «newpassword» afterwards since I am not allowed by the policy to change to an earlier password). The password I enter after passing the «-W» option to ldapmodify is also definetly right, otherwise the error spit out by ldapmodify is that I used invalid credentials instead of a constraint violation.
So — the sole reason I can think of is indeed a bad formatted password — but I can’t figure out where the bad formatting should come from since I use the normal base64 algorythm to encode the password.

Has anyone an idea what is going on?
Can anyone push me in the right direction?

Help is very appreciated and I thank you in advance.

Edit:
Something which bugs me:
When I run the base encoded strings through base64 it keeps telling me «Invalid Input». Now — I went ahead and just re-coded the passwords with the use of base64 on the linux machine — but when I run the generated string through the decode function again, base64 keeps telling me «Invalid Input»… The strings however slightly changed between the windows-base64 encoded string and the linux encoded string. But base64 just says «Invalid input» no matter what I put in there.

Edit2:
Nevermind — reading the purpose of the function I gather that it throws this error because of the dots and the exclamation mark in the password.

I am doing the c# code to change a ldap user’s password by either user himself, or the admin.
I can successfully authenticate the users. However, I get the following error message when I try to invoke a ChangePassword or SetPassword behavior:

InnerException: The directory property cannot be found in the cache.

My code is as follows:

LDAPPath = "LDAP://10.29.0.1:50405/DC=DCServerName,DC=local"
LDAPAdminDN = "CN=useradmin,OU=SystemAccounts,DC=DCServerName,DC=local"
LDAPAdminPwd = "S8kf5t3!"
username = "user1"
password = "oldPassword1"
npassword = "newPassword1"

DirectoryEntry root = new DirectoryEntry(
LDAPPath,
LDAPAdminDN,
LDAPAdminPwd,
AuthenticationTypes.None
);

using (root)
{
    DirectorySearcher searcher = new DirectorySearcher(root,
        string.Format("(CN={0})", username)
        );
    var result = searcher.FindOne();
    if (result != null)
    {
        var user = result.GetDirectoryEntry();
        try
        {
            user.Invoke("ChangePassword", new object[] { password, npassword });
            user.Properties["LockOutTime"].Value = 0; 
            //user.Invoke("SetPassword", new object[] { npassword });
            user.CommitChanges();
        }
        catch (Exception e)
        {
            string innerMsg = e.InnerException.Message;
            return false;
        }
    }

I am wondering how to resolve this problem to change the password successfully. Thank you guys

Update:
I tried several options as below but all of them don’t work:
One:

int intPort = 50405;
user.Invoke("SetOption", new object[] { ADS_OPTION_PASSWORD_PORTNUMBER, intPort });
user.Invoke("SetOption", new object[] { ADS_OPTION_PASSWORD_METHOD, ADS_PASSWORD_ENCODE_CLEAR });

Two:

user.UsePropertyCache = true;

They all get error of 0x80072020

My IT guy enabled «change password on nonSSL», I am not sure any settings matter in AD LDS part.

Question:
Am I right to use an admin account to change a user’s password in this way instead of using any impersonate code?

I currently try to change passwords in our Active Directory Envoirenment via LDAP on Linux since the users in question do not have access to a windows-machine and we want to keep it that way.
In order to change the password I am currently stuck figuring out how to use ldapmodify to do so. After a lot of reading on different sites/forums/newsgroups I am much more confused than before

However:
I try the following command to do so:

ldapmodify -f ldif.example -H ldaps://lab01-dc01.example.com -D 'CN=test,CN=users,DC=lab01,DC=example,DC=com' -x -W

The contents of the ldif.example:

dn: CN=test,CN=Users,DC=lab01,DC=example,DC=com
changetype: modify
delete: unicodePwd
unicodePwd:: V3VQdXV1STEyLg==
-
add: unicodePwd
unicodePwd:: QmxhVVVraTEyLg==
-

(Don’t worry — those passwords are not used anywhere and it is not a production envoirenment)

Now — every time I execute the command I get the following error:

modifying entry CN=test,CN=Users,DC=lab01,DC=example,DC=com"
ldapmodify: Constraint violation (19)
 additional info: 0000216C: AtrErr: DSID-03190EB0, #1:
 0: 0000216C: DSID-03190EB0, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 9005a (unicodePwd)

Now, after what I read the reason for this error is either that the password is badly formatted or that the password policy doesn’t allow the password I used. I checked the policy — multiple times now — and the new password definetly complies to the policy by all the criteria. If I set the password using a Windows-machine it also works well (of course I changed the «oldpassword» and «newpassword» afterwards since I am not allowed by the policy to change to an earlier password). The password I enter after passing the «-W» option to ldapmodify is also definetly right, otherwise the error spit out by ldapmodify is that I used invalid credentials instead of a constraint violation.
So — the sole reason I can think of is indeed a bad formatted password — but I can’t figure out where the bad formatting should come from since I use the normal base64 algorythm to encode the password.

Has anyone an idea what is going on?
Can anyone push me in the right direction?

Help is very appreciated and I thank you in advance.

Edit:
Something which bugs me:
When I run the base encoded strings through base64 it keeps telling me «Invalid Input». Now — I went ahead and just re-coded the passwords with the use of base64 on the linux machine — but when I run the generated string through the decode function again, base64 keeps telling me «Invalid Input»… The strings however slightly changed between the windows-base64 encoded string and the linux encoded string. But base64 just says «Invalid input» no matter what I put in there.

Edit2:
Nevermind — reading the purpose of the function I gather that it throws this error because of the dots and the exclamation mark in the password.

Долго бился над проблемой корректного обновления паролей для авторизуемых через LDAP пользователей.

Настройки умолчанию позволяли корректно логинится и изменять себе пароль без проблем, но в случае истекания срока действия пароля начинались странности —
все необходимые атрибуты проверялись успешно и при логине система корректно рапортовала о необходимости обновления пароля:

You are required to change you LDAP password immediately.

,но после столь обнадеживающей фразы процесс смены пароля заканчивался печально

Authentication failed.

Поиск ничего путного не выдавал по данной проблеме, пришлось дебажить и исправлять самостоятельно.

Ищем проблему

Сначала подозрение пало на некорректно настроенные права доступа в OpenLDAP. Включил полный доступ на запись всем, ситуация не изменилась. При таком поведении, подозрения с LDAP’а были сняты, оставался PAM.

PAM

Просмотрев бегло исходники модуля pam_ldap, и не обнаружив ничего подозрительного начал экспериментировать с общими настройками в /etc/pam.d/common-*
В качестве средства дебага, я воспользовался модулем pam_echo для вывода трейсовых сообщений.

В результате проблема локализовалась в account части, ответственной за проверку «протухания» пароля. После того как она отрабатывала для ldap аккаунтов, передача управления в password не происходило.

Решение

Исходный конфиг для common-account при работе unix и ldap аккаунтов в Ubuntu Server выглядит так:

account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so
account [success=1 default=die] pam_ldap.so
account requisite pam_deny.so
account required pam_permit.so

В результате экспериментов оказалось, что некорректо были настроены секция контрольных флагов (contol-flags) для модуля pam_ldap. Для правильной обработки истекшего пароля необходимо, как и в секции pam_unix, добавить указание для обработки new_authtok_reqd

account [success=1 new_authtok_reqd=done default=die] pam_ldap.so

При внесении данной правки, при попытке залогиниться пользователем с истекшим паролем, форма логина будет радовать нас предложением ввести новый пароль.
Стоит отметить что использование стандартной директивы sufficient вместо детального указания отдельных флагов тоже исправляет проблему с передачей управления дальше.

Проблема и её решение работают и в других дистрибутивах. Так в ALT Легкий и в ПСПО настройки по умолчанию также не позволяют менять пароль при его «протухании» и исправляются аналогичным образом.

Problem Description:

I currently try to change passwords in our Active Directory Envoirenment via LDAP on Linux since the users in question do not have access to a windows-machine and we want to keep it that way.
In order to change the password I am currently stuck figuring out how to use ldapmodify to do so. After a lot of reading on different sites/forums/newsgroups I am much more confused than before

However:
I try the following command to do so:

ldapmodify -f ldif.example -H ldaps://lab01-dc01.example.com -D 'CN=test,CN=users,DC=lab01,DC=example,DC=com' -x -W

The contents of the ldif.example:

dn: CN=test,CN=Users,DC=lab01,DC=example,DC=com
changetype: modify
delete: unicodePwd
unicodePwd:: V3VQdXV1STEyLg==
-
add: unicodePwd
unicodePwd:: QmxhVVVraTEyLg==
-

(Don’t worry – those passwords are not used anywhere and it is not a production envoirenment)

Now – every time I execute the command I get the following error:

modifying entry CN=test,CN=Users,DC=lab01,DC=example,DC=com"
ldapmodify: Constraint violation (19)
 additional info: 0000216C: AtrErr: DSID-03190EB0, #1:
 0: 0000216C: DSID-03190EB0, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 9005a (unicodePwd)

Now, after what I read the reason for this error is either that the password is badly formatted or that the password policy doesn’t allow the password I used. I checked the policy – multiple times now – and the new password definetly complies to the policy by all the criteria. If I set the password using a Windows-machine it also works well (of course I changed the “oldpassword” and “newpassword” afterwards since I am not allowed by the policy to change to an earlier password). The password I enter after passing the “-W” option to ldapmodify is also definetly right, otherwise the error spit out by ldapmodify is that I used invalid credentials instead of a constraint violation.
So – the sole reason I can think of is indeed a bad formatted password – but I can’t figure out where the bad formatting should come from since I use the normal base64 algorythm to encode the password.

Has anyone an idea what is going on?
Can anyone push me in the right direction?

Help is very appreciated and I thank you in advance.

Edit:
Something which bugs me:
When I run the base encoded strings through base64 it keeps telling me “Invalid Input”. Now – I went ahead and just re-coded the passwords with the use of base64 on the linux machine – but when I run the generated string through the decode function again, base64 keeps telling me “Invalid Input”… The strings however slightly changed between the windows-base64 encoded string and the linux encoded string. But base64 just says “Invalid input” no matter what I put in there.

Edit2:
Nevermind – reading the purpose of the function I gather that it throws this error because of the dots and the exclamation mark in the password.

Solution – 1

What about fetching an existsing, working password from a different user and try to include that in your ldif?

This way you will be sure that your password is working.

Second, do not use delete/add use replace instead in the ldif. Maybe the delete will cause an objectclass violation errror.

Third, you only need to base64 encode an attribute if it is contain non-printable or special characters. There is an empty row in the end of the ldif file.

dn: CN=test,CN=Users,DC=lab01,DC=example,DC=com
changetype: modify
replace: unicodePwd
unicodePwd: BlaUUki12.

Regards,

Solution – 2

For future reference, if anyone should encounter similiar problems:
The simple solution? Just use smbpasswd instead of ldap to change the password – that works flawless! I am really grumped that I didn’t think of it before 😀

However – the way to change your password in the active directory using samba (using CentOS):

~#yum install samba
~#smbpasswd -r domaincontroller.example.com -U testuser1
Old SMB password:
New SMB password:
Retype new SMB password:
Password changed for user testuser1 on domaincontroller.example.com

And then you can login using the new password. Easy as that, really.

Solution – 3

yum install samba didn’t work for me as it installed smbpasswd program from samba version 3.6.9.

What worked was yum install samba4-client. This installs smbpasswd program for Samba 4 and this version of smbpasswd actualy can change password on Windows Server 2008 R2 Domain Controller. I used samba4-client as I don’t need the Samba server only it’s client utilities.

The syntax for the smbpasswd command is the same:

smbpasswd -r domaincontroller.example.com -U testuser1    

Hope this helps.

Solution – 4

Constraint error could mean you use an old password that does not conform to the policy of, say, cannot use the last 24 passwords.

For future reference:
Connect to AD server (bind):

• as Admin: you can change and reset passwords for everyone. There is a difference between change and reset. Change = AD will enforce the password policy. Reset = does not.

• as a User: you may change your password but are not allowed to reset it. Change = AD will enforce the password policy.

Hope it helps though it’s a little late!

Solution – 5

When setting the password, it needs to be UTF-16LE and Base64 encoded. In Java, it could be done with:

String source = ""car"";
String utf16base64 = new String(Base64.getEncoder().encode(source.getBytes("UTF-16LE")));

UTF-16LE has to be used, UTF-16 is not enough.

Changing ‘unicodePwd’ over LDAP requires that the new password is a Unicode string with double quotes. It means when you want to set a new password(Password01!) convert the password with double quotes("Password01!") into Base64.

An online tool can be used – http://www5.rptea.com/base64/ (select UTF-16).

Details about unicodePwd are there – https://technet.microsoft.com/en-us/magazine/ff848710.aspx .