Python 3.5, ldap3 and modify_password()

Question

I've been pulling my hair out trying to send a request to update my own password via a script. here is the code:

#!/usr/bin/python3.5

from ldap3 import Server, Connection, NTLM, ALL

server = Server('ldap://192.168.0.80', use_ssl=True)

conn = Connection(server, user="local\\dctest", password="Pa55word1", authentication=NTLM, auto_bind=True)

dn = "CN=dctest,CN=Users,DC=home,DC=local"

conn.extend.microsoft.modify_password(dn, new_password="Pa55word2", old_password="Pa55word1")

The error that i get is:

{'dn': '', 'type': 'modifyResponse', 'description': 'unwillingToPerform', 'referrals': None, 'result': 53, 'message': '00002077: SvcErr: DSID-03190E44, problem 5003 (WILL_NOT_PERFORM), data 0\n\x00'}

Any idea what I'm doing wrong?

I have full access to the DC and I've made sure that the passwords are correct etc. I've read all the docs and just can't get my head around it.

any help would be great!!

can you check your password again. FYI:https://ldapwiki.com/wiki/WILL_NOT_PERFORM — suiwenfeng, Jan 24 '17 at 10:35
Checked(i've reset the password via AD), i've also made the user a domain admin to ensure there are no permission problems. — Comm4nd0, Jan 24 '17 at 10:42
if you think it`s not password issue, try if you can create connection without NTLM first. - authentication=NTLM - — suiwenfeng, Jan 24 '17 at 10:46
can you find modify_password session log in LDAP server? cannot dig more from your description. — suiwenfeng, Jan 24 '17 at 11:26
good idea, i can see that in the logs that the user does login sucsusfully! however, it is instantly logged off again though. — Comm4nd0, Jan 24 '17 at 13:30
if you solve the issue, please answer your own question. if not, please attach the LDAP server log in the description. — suiwenfeng, Jan 24 '17 at 15:13

score 1 · Answer 1 · answered Jan 25 '17 at 09:13

ldap3.modify_password() as of version 0.9.4.2 doesn't work with Active Directory, because it uses the Password Modify Extended Operation, which isn't supported by AD. MS found a way to do things different with AD, it seems. The ldap3 author (cannatag) was aware of this and added ad_modify_password() shortly after. You'll have to use a newer release of ldap3.

score 1 · Accepted Answer · answered Jan 26 '17 at 11:02

1

OK thank you to everyone for your help, and the developers on github.

the code i used to make this work in the end was...

from ldap3 import Server, Connection

server = Server('ldaps://<AD server address>', use_ssl=True)
conn = Connection(server, user="<domain>\\<username>", password="<current password>", auto_bind=True)

dn = 'CN=<username>,OU=Users,DC=<dominaname>'

res = conn.extend.microsoft.modify_password(dn, old_password='<current password>', new_password='<new password>')
print(res)

Thought i'd post the working solution as there doesn't seem to be any on the internets!! God speed my fellow devops people.

answered Jan 26 '17 at 11:02

Comm4nd0

631
8
14

Excuse me, I'm not familiar with LDAP and network. If I use 'ldaps://DOMAIN' as a constructor paramater inside Server, then I must use `use_ssl=True` right? And vice versa? – Tony Chou Aug 28 '20 at 06:10
For the sake of completeness, I've created a [gist](https://gist.github.com/OthmanEmpire/5b3cf976f33975d9777fc3c259eee068) that searches an AD server for a user, then resets their password. – OthmanEmpire Mar 10 '21 at 17:57

score 0 · Answer 3 · answered Jan 23 '17 at 22:11

0

Try with ldaps:// instead of ldap://. or dont use the scheme at all and pass use_ssl=True in the Server definition. AD connection must use ssl to modify the password.

answered Jan 23 '17 at 22:11

cannatag

1,528
11
17

ok so this is what i've tried but it still didn't work: `code server = Server('ldaps://192.168.0.80', get_info=ALL)' – Comm4nd0 Jan 24 '17 at 08:16
Isn't it `ad_modify_password()`? – marabu Jan 24 '17 at 10:07
how would the entire line look? – Comm4nd0 Jan 24 '17 at 11:01
Have a look at [ad_modify_password()](https://github.com/cannatag/ldap3/blob/master/ldap3/extend/microsoft/modifyPassword.py) – marabu Jan 24 '17 at 11:15
ah, ok i've worked out part of the problem. i'm on Debian so i'm using version 0.9.4.2 [link](https://packages.debian.org/jessie/python/python3-ldap3) – Comm4nd0 Jan 24 '17 at 13:11

score 0 · Answer 4 · answered Jan 24 '17 at 16:13

Which version of ldap3 are you using? From the source code of ldap3 version 2.2 it would seem to me that the function should be use in a similar way:

#!/usr/bin/python3.5
from ldap3 import Server, Connection, NTLM, ALL
server = Server('ldap://192.168.0.80', use_ssl=True)
conn = Connection(server, user="local\\dctest", password="Pa55word1", authentication=NTLM, auto_bind=True)
res = ldap3.extend.microsoft.modifyPassword(conn, user, "new_Pa55word2", "old_Pa55word1")

Python 3.5, ldap3 and modify_password()

4 Answers4

Linked