If the passwd exop is not supported allow setting unicodePwd for AD

Signed-off-by: Ferdinand Thiessen <[email protected]>

Author: susnux

lib/LDAPUserManager.php

@@ -339,7 +339,7 @@ public function deleteUser($uid): bool {
 	 *
 	 * @return boolean either the user can or cannot
 	 */
-	public function canSetPassword() {
+	public function canSetPassword(): bool {
 		return $this->configuration->hasPasswordPermission();
 	}
 
@@ -366,20 +366,26 @@ public function setPassword($uid, $password, $connection = null) {
 			if ($ldapConnect->hasPasswdExopSupport($connection)) {
 				$ret = ldap_exop_passwd($connection, $userDN, '', $password);
 				if ($ret === false) {
-					$message = 'ldap_exop_passwd failed, falling back to ldap_mod_replace to to set password for new user';
+					$message = 'Failed to set password for user {dn} using ldap_exop_passwd';
 					$this->logger->log(ILogger::ERROR, $message, [
-						'app' => Application::APP_ID,
 						'ldap_error' => ldap_error($connection),
+						'app' => Application::APP_ID,
+						'dn' => $userDN,
 					]);
 				}
-			}
-
-			// Fallback to `userPassword` in case the server does not support exop_passwd
-			if ($ret === false) {
-				$ret = ldap_mod_replace($connection, $userDN, ['userPassword' => $password]);
+			} else {
+				// Fallback to `userPassword` in case the server does not support exop_passwd
+				$entry = [];
+				if ($this->configuration->useUnicodePassword()) {
+					$entry['unicodePwd'] = iconv('UTF-8', 'UTF-16LE', '"' . $password . '"');
+				} else {
+					$entry['userPassword' => $password]
+				}
+				$ret = ldap_mod_replace($connection, $userDN, $entry);
 				if ($ret === false) {
-					$message = 'Failed to set password for user {dn}';
+					$message = 'Failed to set password for user {dn} using ldap_mod_replace';
 					$this->logger->log(ILogger::ERROR, $message, [
+						'ldap_error' => ldap_error($connection),
 						'app' => Application::APP_ID,
 						'dn' => $userDN,
 					]);

lib/Service/Configuration.php

@@ -52,6 +52,10 @@ public function hasPasswordPermission(): bool {
 		return $this->config->getAppValue('ldap_write_support', 'hasPasswordPermission', '1') === '1';
 	}
 
+	public function useUnicodePassword(): bool {
+		return $this->config->getAppValue('ldap_write_support', 'useUnicodePassword', '0') === '1';
+	}
+
 	public function getUserTemplate() {
 		return $this->config->getAppValue(
 			Application::APP_ID,

lib/Settings/Admin.php

@@ -64,6 +64,7 @@ public function getForm() {
 				'hasPasswordPermission' => $this->config->hasPasswordPermission(),
 				'newUserRequireEmail' => $this->config->isRequireEmail(),
 				'newUserGenerateUserID' => $this->config->isGenerateUserId(),
+				'useUnicodePassword' => $this->config->useUnicodePassword(),
 			]
 		);
 		return new TemplateResponse(Application::APP_ID, 'settings-admin');

src/components/AdminSettings.vue

@@ -48,6 +48,11 @@
 				@change.stop.prevent="toggleSwitch('hasPasswordPermission', !switches.hasPasswordPermission)">
 				{{ t('ldap_write_support', 'Allow users to set their password') }}
 			</ActionCheckbox>
+			<ActionCheckbox :checked="switches.useUnicodePassword"
+				:title="t('ldap_write_support', 'If the server does not support the modify password extended operation use the `unicodePwd` instead of the `userPassword` attribute for setting the password')"
+				@change.stop.prevent="toggleSwitch('useUnicodePassword', !switches.useUnicodePassword)">
+				{{ t('ldap_write_support', 'Use the `unicodePwd` attribute for setting the user password') }}
+			</ActionCheckbox>
 		</ul>
 		<h3>{{ t('ldap_write_support', 'User template') }}</h3>
 		<p>{{ t('ldap_write_support', 'LDIF template for creating users. Following placeholders may be used') }}</p>