Do not rely on exop_passwd but check rootDSE for support and fallback to mod_replace

This should fix AD support

Signed-off-by: Ferdinand Thiessen <[email protected]>

Author: susnux

lib/LDAPConnect.php

@@ -33,8 +33,11 @@ class LDAPConnect {
 	private $ldapConfig;
 	/** @var LoggerInterface */
 	private $logger;
+	/** @var bool|null */
+	private $passwdSupport;
 
 	public function __construct(Helper $ldapBackendHelper, LoggerInterface $logger) {
+		$this->passwdSupport = null;
 		$this->logger = $logger;
 		$ldapConfigPrefixes = $ldapBackendHelper->getServerConfigurationPrefixes(true);
 		$prefix = array_shift($ldapConfigPrefixes);
@@ -145,4 +148,29 @@ public function hasPasswordPolicy(): bool {
 		$ppDN = $this->ldapConfig->ldapDefaultPPolicyDN;
 		return !empty($ppDN);
 	}
+
+	/**
+	 * checks whether the LDAP server supports the passwd exop
+	 *
+	 * @param LDAP\Connection $connection LDAP connection to check
+	 * @return boolean either the user can or cannot
+	 */
+	public function hasPasswdExopSupport():bool {
+		if (is_null($this->passwdSupport)) {
+			$ret = ldap_read($connection, '', '(objectclass=*)', ['supportedExtension']);
+			if ($ret === false) {
+				$this->passwdSupport = false;
+				return false;
+			}
+			$ret = ldap_first_entry($connection, $ret);
+			if ($ret === false) {
+				$this->passwdSupport = false;
+				return false;
+			}
+
+			$values = ldap_get_values($connection, $ret, 'supportedExtension');
+			$this->passwdSupport = ($values !== false) && in_array(LDAP_EXOP_MODIFY_PASSWD, $values['supportedExtension']);
+		}
+		return $this->passwdSupport;
+	}
 }

lib/LDAPUserManager.php

@@ -87,7 +87,7 @@ public function __construct(IUserManager $userManager, IUserSession $userSession
 	 * compared with OC_USER_BACKEND_CREATE_USER etc.
 	 */
 	public function respondToActions() {
-		$setPassword = function_exists('ldap_exop_passwd') && !$this->ldapConnect->hasPasswordPolicy()
+		$setPassword = $this->canSetPassword() && !$this->ldapConnect->hasPasswordPolicy()
 			? Backend::SET_PASSWORD
 			: 0;
 
@@ -247,29 +247,8 @@ public function createUser($username, $password) {
 			throw new \Exception('Cannot create user: ' . ldap_error($connection), ldap_errno($connection));
 		}
 
-		// Set password through ldap password exop, if supported
 		if ($this->respondToActions() & Backend::SET_PASSWORD) {
-			try {
-				$ret = ldap_exop_passwd($connection, $newUserDN, '', $password);
-				if ($ret === false) {
-					$message = 'ldap_exop_passwd failed, falling back to ldap_mod_replace to to set password for new user';
-					$this->logger->log(ILogger::DEBUG, $message, [
-						'app' => Application::APP_ID,
-					]);
-
-					// Fallback to `userPassword` in case the server does not support exop_passwd
-					$ret = ldap_mod_replace($connection, $newUserDN, ['userPassword' => $password]);
-					if ($ret === false) {
-						$message = 'Failed to set password for new user {dn}';
-						$this->logger->log(ILogger::ERROR, $message, [
-							'app' => Application::APP_ID,
-							'dn' => $newUserDN,
-						]);
-					}
-				}
-			} catch (\Exception $e) {
-				$this->logger->logException($e, ['app' => Application::APP_ID]);
-			}
+			$this->setPassword($username, $password, $connection);
 		}
 		return $ret ? $newUserDN : false;
 	}
@@ -355,30 +334,62 @@ public function deleteUser($uid): bool {
 		return $res;
 	}
 
+	/**
+	 * checks whether the user is allowed to change their password in Nextcloud
+	 *
+	 * @return boolean either the user can or cannot
+	 */
+	public function canSetPassword() {
+		return $this->configuration->hasPasswordPermission();
+	}
+
 	/**
 	 * Set password
 	 *
 	 * @param string $uid The username
 	 * @param string $password The new password
+	 * @param ?LDAP\Connection $connection LDAP connection or null to create one
 	 * @return bool
 	 *
 	 * Change the password of a user
 	 */
-	public function setPassword($uid, $password) {
-		if (!function_exists('ldap_exop_passwd')) {
-			// since PHP 7.2 – respondToActions checked this already, this
-			// method should not be called. Double check due to public scope.
-			// This method can be removed when Nextcloud 16 compat is dropped.
-			return false;
+	public function setPassword($uid, $password, $connection = null) {
+		if (is_null($connection)) {
+			$connection = $this->ldapProvider->getLDAPConnection($uid);
 		}
+		
 		try {
-			$cr = $this->ldapProvider->getLDAPConnection($uid);
 			$userDN = $this->getUserDN($uid);
-			return ldap_exop_passwd($cr, $userDN, '', $password);
+			$ret = false;
+
+			// try ldap_exop_passwd first
+			if ($ldapConnect->hasPasswdExopSupport($connection)) {
+				$ret = ldap_exop_passwd($connection, $userDN, '', $password);
+				if ($ret === false) {
+					$message = 'ldap_exop_passwd failed, falling back to ldap_mod_replace to to set password for new user';
+					$this->logger->log(ILogger::ERROR, $message, [
+						'app' => Application::APP_ID,
+						'ldap_error' => ldap_error($connection),
+					]);
+				}
+			}
+
+			// Fallback to `userPassword` in case the server does not support exop_passwd
+			if ($ret === false) {
+				$ret = ldap_mod_replace($connection, $userDN, ['userPassword' => $password]);
+				if ($ret === false) {
+					$message = 'Failed to set password for user {dn}';
+					$this->logger->log(ILogger::ERROR, $message, [
+						'app' => Application::APP_ID,
+						'dn' => $userDN,
+					]);
+				}
+			}
+			return $ret;
 		} catch (\Exception $e) {
 			$this->logger->logException($e, ['app' => Application::APP_ID]);
+			return false;
 		}
-		return false;
 	}
 
 	/**

lib/Service/Configuration.php

@@ -48,6 +48,10 @@ public function hasAvatarPermission(): bool {
 		return $this->config->getAppValue('ldap_write_support', 'hasAvatarPermission', '1') === '1';
 	}
 
+	public function hasPasswordPermission(): bool {
+		return $this->config->getAppValue('ldap_write_support', 'hasPasswordPermission', '1') === '1';
+	}
+
 	public function getUserTemplate() {
 		return $this->config->getAppValue(
 			Application::APP_ID,

lib/Settings/Admin.php

@@ -61,6 +61,7 @@ public function getForm() {
 				'createRequireActorFromLdap' => $this->config->isLdapActorRequired(),
 				'createPreventFallback' => $this->config->isPreventFallback(),
 				'hasAvatarPermission' => $this->config->hasAvatarPermission(),
+				'hasPasswordPermission' => $this->config->hasPasswordPermission(),
 				'newUserRequireEmail' => $this->config->isRequireEmail(),
 				'newUserGenerateUserID' => $this->config->isGenerateUserId(),
 			]

src/components/AdminSettings.vue

@@ -44,6 +44,10 @@
 				@change.stop.prevent="toggleSwitch('hasAvatarPermission', !switches.hasAvatarPermission)">
 				{{ t('ldap_write_support', 'Allow users to set their avatar') }}
 			</ActionCheckbox>
+			<ActionCheckbox :checked="switches.hasPasswordPermission"
+				@change.stop.prevent="toggleSwitch('hasPasswordPermission', !switches.hasPasswordPermission)">
+				{{ t('ldap_write_support', 'Allow users to set their password') }}
+			</ActionCheckbox>
 		</ul>
 		<h3>{{ t('ldap_write_support', 'User template') }}</h3>
 		<p>{{ t('ldap_write_support', 'LDIF template for creating users. Following placeholders may be used') }}</p>