哪个 Active Directory 的属性对应于 PHP 中的 ldap_bind function 的“bind_password”参数

Question

I am creating an API for registration and authentication by Active Directory.

When registering, I use the "userPassword" field to store the password.

$user = new User([
    'cn' => $full_name,
    'userPassword' => $password,
    'samaccountname' => $username,
    'mail' => $email
]);

$user->inside(config('ldap.connections.default.base_dn'));

$user->save();

Registration works fine. But at the time of authentication, the Active Directory does not recognize the provided password:

$user = User::where('samaccountname', '=', $username)->firstOrFail(); // all is good here. print_r($user) shows user details

if (Container::getDefaultConnection()->auth()->attempt($user['distinguishedname'], $password)) {

    // returns a response to the user
    return \response()->json(
        new UserResource($user), 200
    );

} else {

    return \response()->json(
        [
            'message' => 'invalid credentials or user not exists.'
        ], 403
    );
}

Can someone help me.

Answer 1

Using plain stored password won't work, there are some encoding which need to be carried out but there's a mutator unicodePwd that will handle it for you. Try

$user = new User([
    'cn' => $full_name,
    'unicodePwd ' => $password,
    'samaccountname' => $username,
    'mail' => $email
]);

Answer 2

The attribute used to set the password of an account is unicodePwd . This attribute can only be set, not read.

There are some strict requirements about the format of what you put there, which are described in the Microsoft documentation. However, the LdapRecord library handles that for you, according to their documentation :

The password string you set on the users unicodePwd attribute is automatically encoded, you do not need to encode it yourself.

Their example on how to create an AD user looks like this:

$user = (new User)->inside('ou=Users,dc=local,dc=com');

$user->cn = 'John Doe';
$user->samaccountname = 'jdoe';
$user->unicodePwd = 'SecretPassword';
$user->userPrincipalName = 'jdoe@acme.org';

$user->save();

// Enable the user.
$user->userAccountControl = 512;

try {
    $user->save();
} catch (\LdapRecord\LdapRecordException $e) {
    // Failed saving user.
}