If the passwd exop is not supported allow setting unicodePwd for AD

Signed-off-by: Ferdinand Thiessen <[email protected]>

Author: susnux

lib/LDAPConnect.php

@@ -155,7 +155,7 @@ public function hasPasswordPolicy(): bool {
 	 * @param LDAP\Connection $connection LDAP connection to check
 	 * @return boolean either the user can or cannot
 	 */
-	public function hasPasswdExopSupport():bool {
+	public function hasPasswdExopSupport($connection):bool {
 		if (is_null($this->passwdSupport)) {
 			$ret = ldap_read($connection, '', '(objectclass=*)', ['supportedExtension']);
 			if ($ret === false) {

lib/LDAPUserManager.php

@@ -37,6 +37,7 @@
 use OCA\User_LDAP\IUserLDAP;
 use OCP\IImage;
 use OCP\IL10N;
+use OCP\ILogger;
 use OCP\IUser;
 use OCP\IUserManager;
 use OCP\IUserSession;
@@ -376,7 +377,11 @@ public function setPassword($uid, $password, $connection = null) {
 			} else {
 				// Fallback to `userPassword` in case the server does not support exop_passwd
 				$entry = [];
-					$entry['userPassword' => $password]
+				if ($this->configuration->useUnicodePassword()) {
+					$entry['unicodePwd'] = iconv('UTF-8', 'UTF-16LE', '"' . $password . '"');
+				} else {
+					$entry['userPassword'] = $password;
+				}
 				$ret = ldap_mod_replace($connection, $userDN, $entry);
 				if ($ret === false) {
 					$message = 'Failed to set password for user {dn} using ldap_mod_replace';
@@ -389,7 +394,11 @@ public function setPassword($uid, $password, $connection = null) {
 			}
 			return $ret;
 		} catch (\Exception $e) {
-			$this->logger->error($e, ['app' => Application::APP_ID]);
+			$this->logger->log(ILogger::ERROR, 'Exception occured while setting the password of user {dn}', [
+				'app' => Application::APP_ID,
+				'exception' => $e,
+				'dn' => $uid
+			]);
 			return false;
 		}
 	}

lib/Service/Configuration.php

@@ -52,6 +52,10 @@ public function hasPasswordPermission(): bool {
 		return $this->config->getAppValue('ldap_write_support', 'hasPasswordPermission', '1') === '1';
 	}
 
+	public function useUnicodePassword(): bool {
+		return $this->config->getAppValue('ldap_write_support', 'useUnicodePassword', '0') === '1';
+	}
+
 	public function getUserTemplate() {
 		return $this->config->getAppValue(
 			Application::APP_ID,

lib/Settings/Admin.php

@@ -64,6 +64,7 @@ public function getForm() {
 				'hasPasswordPermission' => $this->config->hasPasswordPermission(),
 				'newUserRequireEmail' => $this->config->isRequireEmail(),
 				'newUserGenerateUserID' => $this->config->isGenerateUserId(),
+				'useUnicodePassword' => $this->config->useUnicodePassword(),
 			]
 		);
 		return new TemplateResponse(Application::APP_ID, 'settings-admin');

src/components/AdminSettings.vue

@@ -48,6 +48,11 @@
 				@change.stop.prevent="toggleSwitch('hasPasswordPermission', !switches.hasPasswordPermission)">
 				{{ t('ldap_write_support', 'Allow users to set their password') }}
 			</ActionCheckbox>
+			<ActionCheckbox :checked="switches.useUnicodePassword"
+				:title="t('ldap_write_support', 'If the server does not support the modify password extended operation use the `unicodePwd` instead of the `userPassword` attribute for setting the password')"
+				@change.stop.prevent="toggleSwitch('useUnicodePassword', !switches.useUnicodePassword)">
+				{{ t('ldap_write_support', 'Use the `unicodePwd` attribute for setting the user password') }}
+			</ActionCheckbox>
 		</ul>
 		<h3>{{ t('ldap_write_support', 'User template') }}</h3>
 		<p>{{ t('ldap_write_support', 'LDIF template for creating users. Following placeholders may be used') }}</p>