Unable to change password of user with $who_change_password = "user"

[WesleyMiddelbosIS]

We are moving away from Passcore and want to use this self-service-password tool to give users, which are existing in ad, the abillity to change there passwords before expiration.

We are having problems though. It seems like the binding of the search does not succeed. Can someone please explain why this won't work?

Things to keep in mind:

• We run self-service-password in docker
• The docker runs outside of the ad domain
• Firewall has been configured correctly
• Following the documentation we assume that we don't need to define ldap_binddn and ldap_bindpw in order to make this to work.

config.inc.local.php:

$lang = "nl";
$allowed_lang = array("en","nl");

$show_menu = false;
$debug = true;
$default_action = "change";
$keyphrase = bin2hex(openssl_random_pseudo_bytes(16));
$use_tokens = false;
$use_sms = false;
$use_questions = false;
$background_image = "";
$background_color = "";
$logo = "images/logo.png";
$display_footer = false;
$custom_css = "css/custom.css";

$ldap_url = "ldaps://{REDACTED} ldaps://{REDACTED}";
$ldap_binddn = "";
$ldap_bindpw = "";
$who_change_password = "user";
$ldab_base = "OU={REDACTED},OU={REDACTED},DC={REDACTED},DC={REDACTED}";

$ad_mode = true;
$ldap_filter = "(&(objectClass=user)(sAMAccountName={login})(!(userAccountControl:1.2.840.113556.1.4.803:=2)))";

ldap.conf:

TLS_CACERT /etc/ssl/certs/{REDACTED}.crt

DEBUG LOG:

ldap_url_parse_ext(ldap://localhost/)
ldap_init: trying /etc/ldap/ldap.conf
ldap_init: using /etc/ldap/ldap.conf
ldap_init: HOME env is NULL
ldap_init: trying ldaprc
ldap_init: LDAPCONF env is NULL
ldap_init: LDAPRC env is NULL
ldap_create
ldap_url_parse_ext(ldaps://{REDACTED})
ldap_url_parse_ext(ldaps://{REDACTED})
ldap_sasl_bind_s
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP {REDACTED}:636
ldap_new_socket: 11
ldap_prepare_socket: 11
ldap_connect_to_host: Trying {REDACTED}:636
ldap_pvt_connect: fd: 11 tm: 10 async: 0
ldap_ndelay_on: 11
attempting to connect:
connect errno: 115
ldap_int_poll: fd: 11 tm: 10
ldap_is_sock_ready: 11
ldap_ndelay_off: 11
ldap_pvt_connect: 0
ldap_open_defconn: successful
ldap_send_server_request
ldap_result ld 0x5624e8d5cce0 msgid 1
wait4msg ld 0x5624e8d5cce0 msgid 1 (infinite timeout)
wait4msg continue ld 0x5624e8d5cce0 msgid 1 all 1
** ld 0x5624e8d5cce0 Connections:
* host: {REDACTED}  port: 636  (default)
* from: IP={REDACTED}:38092
  refcnt: 2  status: Connected
  last used: Wed Dec  4 14:05:33 2024


** ld 0x5624e8d5cce0 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x5624e8d5cce0 request count 1 (abandoned 0)
** ld 0x5624e8d5cce0 Response Queue:
   Empty
  ld 0x5624e8d5cce0 response count 0
ldap_chkResponseList ld 0x5624e8d5cce0 msgid 1 all 1
ldap_chkResponseList returns ld 0x5624e8d5cce0 NULL
ldap_int_select
read1msg: ld 0x5624e8d5cce0 msgid 1 all 1
ldap_find_request_by_msgid: msgid 1, lr 0x5624e8eafdf0 lr->lr_refcnt = 1
read1msg: ld 0x5624e8d5cce0 msgid 1 message type bind
read1msg: ld 0x5624e8d5cce0 0 new referrals
read1msg:  mark request completed, ld 0x5624e8d5cce0 msgid 1
request done: ld 0x5624e8d5cce0 msgid 1
res_errno: 0, res_error: <>, res_matched: <>
ldap_return_request: lrx 0x5624e8eafdf0, lr 0x5624e8eafdf0
ldap_return_request: lrx->lr_msgid 1, lrx->lr_refcnt is now 0, lr is still present
ldap_free_request (origid 1, msgid 1)
ldap_free_request_int: lr 0x5624e8eafdf0 msgid 1 removed
ldap_do_free_request: asked to free lr 0x5624e8eafdf0 msgid 1 refcnt 0
ldap_parse_result
ldap_msgfree
ldap_search_ext
put_filter: "(&(objectClass=user)(sAMAccountName={REDACTED})(!(userAccountControl:1.2.840.113556.1.4.803:=2)))"
put_filter: AND
put_filter_list "(objectClass=user)(sAMAccountName={REDACTED})(!(userAccountControl:1.2.840.113556.1.4.803:=2))"
put_filter: "(objectClass=user)"
put_filter: simple
put_simple_filter: "objectClass=user"
put_filter: "(sAMAccountName={REDACTED})"
put_filter: simple
put_simple_filter: "sAMAccountName={REDACTED}"
put_filter: "(!(userAccountControl:1.2.840.113556.1.4.803:=2))"
put_filter: NOT
put_filter_list "(userAccountControl:1.2.840.113556.1.4.803:=2)"
put_filter: "(userAccountControl:1.2.840.113556.1.4.803:=2)"
put_filter: simple
put_simple_filter: "userAccountControl:1.2.840.113556.1.4.803:=2"
ldap_build_search_req ATTRS: *
ldap_send_initial_request
ldap_send_server_request
ldap_result ld 0x5624e8d5cce0 msgid 2
wait4msg ld 0x5624e8d5cce0 msgid 2 (infinite timeout)
wait4msg continue ld 0x5624e8d5cce0 msgid 2 all 1
** ld 0x5624e8d5cce0 Connections:
* host: {REDACTED}  port: 636  (default)
* from: IP={REDACTED}:38092
  refcnt: 2  status: Connected
  last used: Wed Dec  4 14:05:33 2024


** ld 0x5624e8d5cce0 Outstanding Requests:
 * msgid 2,  origid 2, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x5624e8d5cce0 request count 1 (abandoned 0)
** ld 0x5624e8d5cce0 Response Queue:
   Empty
  ld 0x5624e8d5cce0 response count 0
ldap_chkResponseList ld 0x5624e8d5cce0 msgid 2 all 1
ldap_chkResponseList returns ld 0x5624e8d5cce0 NULL
ldap_int_select
read1msg: ld 0x5624e8d5cce0 msgid 2 all 1
ldap_find_request_by_msgid: msgid 2, lr 0x5624e8eb3290 lr->lr_refcnt = 1
read1msg: ld 0x5624e8d5cce0 msgid 2 message type search-result
read1msg: ld 0x5624e8d5cce0 0 new referrals
read1msg:  mark request completed, ld 0x5624e8d5cce0 msgid 2
request done: ld 0x5624e8d5cce0 msgid 2
res_errno: 1, res_error: <000004DC: LdapErr: DSID-0C090C77, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4563>, res_matched: <>

[WesleyMiddelbosIS]

Fixed it