Active Directory密码重置

Question

We're trying to implement a php-based active directory password reset for our local intranet. One of the major requirements is that it respects the password policies set up in AD.

I've got a solution working well for when a user wants to reset their password, and they know their old password - essentially just a remove/add batch.

However, I'm having trouble figuring out a solution for when a user has forgotten their password. Because we don't know the old password, we'd have to do an administrative reset, but that doesn't respect the password policy. Alternatively, we could administratively reset the password, and then immediately force the user change their password. Unfortunately, doing two password resets in a row would force us to have the 'password minimum age' requirement turned off.

It seems like this has to be a typical use-case, so I'm guessing I'm just missing something obvious?

Thanks!

Answer 1

To have an administrative password reset respect the AD Password Policy for the user you must use a specific control OID. There has been a patch in the PHP bug tracker for a while to implement this functionality in an easier form:

https://bugs.php.net/bug.php?id=69445

It's still possible to do without this patch, but the encoding for the value used by the control is the hard part. Luckily someone else has already figured it out. See this answer for what you're looking for:

https://stackoverflow.com/a/26763748/2242593