I'm attempting to update a password via a portlet in Quercus using java libraries. Here is some of the code that I'm using:
import javax.naming.Context;
import javax.naming.InitialContext;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;
import javax.naming.directory.BasicAttributes;
import javax.naming.directory.BasicAttribute;
import javax.naming.directory.SearchControls;
import javax.sql.DataSource;
import java.util.Hashtable;
$uname = isset($_POST['uname'])?$_POST['uname']:'';
$pass1 = isset($_POST['pass1'])?$_POST['pass1']:'';
//connecto to LDAP
$ldapADURL = "ldaps://poplar.example.edu:636";
$ldapEnv = new HashTable();
$ldapEnv->put("java.naming.factory.initial","com.sun.jndi.ldap.LdapCtxFactory");
$ldapEnv->put("java.naming.provider.url", $ldapADURL);
$ldapEnv->put("java.naming.security.protocal", "ssl");
$ldapEnv->put("java.naming.referral", "follow");
$ldapEnv->put("java.naming.security.authentication", "simple");
$ldapEnv->put("java.naming.security.principal", "ADUser");
$ldapEnv->put("java.naming.security.credentials", "P@ssw0rd");
$ADCtx = new InitialDirContext($ldapEnv);
//query the vault for our user
$ctlsAD = new SearchControls();
$attribsAD = array("sAMAccountName","DN","title","extensionAttribute14","extensionAttribute8","cn");
$ctlsAD->setReturningAttributes($attribsAD);
$ctlsAD->setSearchScope(2);
$filter="(sAMAccountName=" . $uname . ")";
$resultAD=$ADCtx->search("DC=conncoll,DC=edu",$filter,$ctlsAD);
if ($resultAD->hasMore()) {
$item = $resultAD->next();
$resultADAttribs = $item->getAttributes();
$rsTitle = str_replace("title: ","",$resultADAttribs->get("title"));
$rsAttrib14 = str_replace("extensionAttribute14: ","",$resultADAttribs->get("extensionAttribute14"));
$rsAttrib8 = str_replace("extensionAttribute8: ","",$resultADAttribs->get("extensionAttribute8"));
$rsUname = str_replace("sAMAccountName: ","",$resultADAttribs->get("sAMAccountName"));
$rsDN = str_replace("dn: ","",$resultADAttribs->get("DN"));
}
echo ( '<br />' . $rsTitle . '<br />' . $rsAttrib14 . '<br />' . $rsAttrib8 . '<br />' . $rsUname . '<br />' . $rsDN . '<br />');
if (isset($rsUname)/*ccLDAPCheckUser($uname)*/){
$ADCtx->addToEnvironment("java.naming.security.principal","OtherADUser");
$ADCtx->addToEnvironment("java.naming.security.credentials","0therP@ssw0rd");
//$resultAD2 = $ADCtx->search("DC=conncoll,DC=edu",$filter,$ctlsAD);
$pass2 = "\"" . $pass1 . "\"";
$newPass = mb_convert_encoding($pass2, "UTF-16LE");
$ADNewPass = new BasicAttribute("userpassword",$newPass);
$ADNewAttrib8 = new BasicAttribute("extensionAttribute8",$rsAttrib8);
$ADAttributes = new BasicAttributes();
$ADAttributes->put($ADNewPass);
$ADAttributes->put($ADNewAttrib8);
$ADCtx->modifyAttributes("sAMAccountName=" . $rsUname,2,$ADAttributes);
}
After running this code I get the following error from the LDAP server: javax.naming.directory.InitialDirContext.modifyAttributes: [LDAP: error code 1 - 000020D6: SvcErr: DSID-031007DB, problem 5012 (DIR_ERROR), data 0 ]
So I'm wondering several things. The first is if I have the syntax of the modifyAttributes function call correct. I've tried it with dc=example,dc=edu tacked on to the query string to no success. The first query returns results correctly so I'm sure that I'm getting connected to the AD server and I've had someone verify that the JVM executing the code has a valid up-to-date certificate in its store.
The error makes me believe that I need the exact location specified for the object I'm attempting to update, which I don't have.
Thanks for your thoughts on the issue!
