0

In Nodejs how to reset active directory password without knowing the current password?

I use the below 2 libraries at the moment.

https://www.npmjs.com/package/activedirectory

http://ldapjs.org/index.html

I have the below code which works perfectly if I know the current password. But I also want to reset password, if I dont know the current password.

function modifyPassword() {

   return new Promise((resolve, reject) => {

    try {
      //ldapClient.bind(userDN, oldPassword, err => {
      ldapClient.bind(service_acc_user, service_acc_pwd, err => {
        if (err) {
          reject(err);
        }

        ldapClient.modify(userDN, [
          new ldap.Change({
            operation: 'delete',
            modification: {
              unicodePwd: encodePassword(oldPassword)
            }
          }),
          new ldap.Change({
            operation: 'add',
            modification: {
              unicodePwd: encodePassword(newPassword)
            }
          })
        ], (error) => {
          if (error) {
            reject(error);
          } else {
            resolve('Successfully password modified.');
          }
        });
      })
    } catch (error) {
      console.error(error);
      reject(error);

       }
      })
}

I tried to use the above code by passing a dummy current password but got the below error.

'00000056: AtrErr: DSID-03190F80, #1:\n\t0: 00000056: DSID-03190F80, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 9005a (unicodePwd)\n\u0000'
Jay
  • 9,189
  • 12
  • 56
  • 96
  • In ADS you will need another account which has the privileges to set the password of another account. The users can't reset their own password if they have lost it. – André Schild Apr 25 '19 at 14:16
  • Jay, you are not using the ActiveDirectory but rather calling the AD using ldapjs to modify the password. I am pretty sure the ActiveDirectory package is a querying the AD and do not have modification option. Am i correct? – Yuvi Aug 13 '19 at 15:00

1 Answers1

2

When sending add and delete at the same time Active Directory treats it as a normal password reset, to perform an administrator password reset Active Directory only expects to receive the replace command.

I posted on the Github issue, but came here in hopes of getting the correct answer points. :D

tastypackets
  • 41
  • 3