nextcloud / nextcloud/ldap_write_support
LDAP sambaNTPassword not set by password change
Open
Nobody has claimed this yet.
1. to develop
enhancement
- Dominant language
- PHP
- Stars
- 33
- Forks
- 14
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 13
Description
This plugin does not handle LDAP Samba extensions, when used by LDAP server (which is often used)
So I have to modify the code of the plugin to this to work:
public function setPassword($uid, $password) {
$possible = '0123456789'.
'abcdefghijklmnopqrstuvwxyz'.
'ABCDEFGHIJKLMNOPQRSTUVWXYZ'.
'./';
$salt = '';
$userdata=array();
while (strlen($salt) < 16)
$salt .= substr($possible, (rand() % strlen($possible)), 1);
// Convert the password from UTF8 to UTF16 (little endian)
$MD4Hash=hash('md4',iconv('UTF-8','UTF-16LE',$password));
// Make it uppercase, not necessary, but it's common to do so with NTLM hashes
$NTLMHash=strtoupper($MD4Hash);
$now = time();
try {
$cr = $this->ldapProvider->getLDAPConnection($uid);
$userDN = $this->getUserDN($uid);
// TODO: check if LDAP contains sambaNTpassword
//$object = ldap_get_attributes($ldap, $entry);
// if (isset($object['sambaNTPassword'])){
$userdata['userPassword'] = '{CRYPT}'.crypt($password, '$6$'.$salt.'$');
$userdata['sambaNTPassword'] = $NTLMHash;
$userdata['sambaPwdLastSet'] = "$now";
return ldap_modify($cr, $userDN, $userdata) !== false;
} catch (\Exception $e) {
$this->logger->error($e->getMessage(), ['exception' => $e, 'app' => Application::APP_ID]);
}
return false;
}
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the setPassword($uid, $password) entry point and inspect how ldapProvider, getLDAPConnection(), getUserDN(), and ldap_modify() are used in the current password-change path. Compare the existing LDAP update behavior with the Samba attributes shown in the issue, then verify that a password change updates the required attributes without breaking ordinary LDAP password changes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100