警告：ldap_modify（）：修改：服务器不愿意执行

Question

I really struggling here with the integration between Active Directory and PHP. The fields I am trying to update are: givenname, sn, mail, telephonenumber, company, department and title. It is giving me the following error:

Warning: ldap_modify(): Modify: Server is unwilling to perform in E:\IIS^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

From searching the internet I have found that I have to use LDAPS instead of LDAP but I do not know what is wrong here:

function get_active_directory_info($username, $password)
{
    $conn         = ldap_connect("DC-1");
    if($conn==FALSE)
    {
        return array(FALSE, FALSE);
    }
    else
    {
        $bind = ldap_bind($conn, $username, $password);
        ldap_set_option($conn, LDAP_OPT_PROTOCOL_VERSION,3);
        ldap_set_option($conn, LDAP_OPT_REFERRALS,0);
        $unit         = "OU=Staff,OU=Users,DC=example,DC=internal";
        $filter         = "(&(objectCategory=person)(sAMAccountName=*)(!(UserAccountControl=514)))";
        $results        = array();
        $justthese     = array("sn", "givenname", "mail", "company","department","title","telephonenumber","samaccountname", "cn");
        $sr=ldap_search($conn, $unit, $filter, $justthese);
        $info = ldap_get_entries($conn, $sr);        
        for($i = 0; $i < $info["count"]; $i++)
        {
            $cn = $info[$i]["cn"][0];
            if(substr($cn, -3) != "ADM")
            {
                $results[$i]["id"] = $i + 1;
                if(empty($info[$i]["givenname"][0])==FALSE)
                {
                    $results[$i]["first"] = $info[$i]["givenname"][0];
                }
                if(empty($info[$i]["sn"][0])==FALSE)
                {
                    $results[$i]["last"] = $info[$i]["sn"][0];
                }
                if(empty($info[$i]["mail"][0])==FALSE)
                {
                    $results[$i]["email"] = $info[$i]["mail"][0];
                }    
                if(empty($info[$i]["company"][0])==FALSE)
                {
                    $results[$i]["company"] = $info[$i]["company"][0];
                }
                if(empty($info[$i]["title"][0])==FALSE)
                {
                    $results[$i]["title"] = $info[$i]["title"][0];
                }    
                if(empty($info[$i]["department"][0])==FALSE)
                {
                    $results[$i]["department"] = $info[$i]["department"][0];
                }    
                if(empty($info[$i]["telephonenumber"][0])==FALSE)
                {
                    $results[$i]["number"] = $info[$i]["telephonenumber"][0];
                }    
                if(empty($info[$i]["samaccountname"][0])==FALSE)
                {
                    $results[$i]["username"] = $info[$i]["samaccountname"][0];
                }
            }
        }
    }    
    return $results;    
}  

Answer 1

If I remember correctly, you need LDAPs for changing passwords, I see you are not doing that. Have you also tried this with a more simplistic example, just to try if it works?

I have changed the following code with the information you supplied but you should change the host, usernames and passwords. What happens when you try this.

$r=ldap_bind($ds, "username", "password");

$ldapconn = ldap_connect("LDAP://HOST:389");

if ($ldapconn) {

    // binding to ldap server
    $ldapbind = ldap_bind($ldapconn, "username", "password");

    $justthese = array("otherTelephone");

    $search = ldap_search($ldapconn,"OU=Staff,OU=Users,DC=example,DC=internal", "(&(objectCategory=person)(sAMAccountName=*)(!(UserAccountControl=514)))", $justthese);

    $entry = ldap_get_entries($ldapconn, $search);

    $dn=$entry[0]["dn"];

    $userdata=array();
    $userdata["otherTelephone"][0]= "NEWPHONENUMBER";       
    ldap_modify($ldapconn, $dn, $userdata);
}   

Let me know what happens.

Answer 2

您必须使用LDAP加密来设置Microsoft Active Directory的密码