How to get password of active directory by ldap in php?

Question

I have problem about password in Active Directory. I want to get password from "username" of user I tried function "ldap_search", but I do not find correctly attribute for password I tried as: password, userpassword, userPassword, unicodePwd, unicodepwd, but they are not correct.

I look forward to helping of everyone Thanks for all :D trankinhly

Solution 1

Passwords in Active Directory are not retrievable. Nor are they in most directories. (eDirectory has a password policy, that if you bind as the specified user, then you can retrieve passwords via LDAP extensions)

Some directories might let you recover the hashed versions, but that is not that great either.

To be cross platform, it is better to try and bind with the values provided and either succeed or fail. Additionally, LDAP says a bind with a blank password is actually an anonymous bind, which will probably succeed, so you need to filter for that case.

Once bound as the user, you could look at their group memberships (since usually they can see their own) or look at some other attribute, which if they can read it, means they have some level of rights. (I.e. Implement authorization as well as authentication).

Solution 2

I just queried an Active Directory (using ldapsearch in Ubuntu 10.04) running on a MS-Windows Server 2003, and it seem only the following can be retrieved and note that the password is not there.

givenName
distinguishedName
instanceType
whenCreated
whenChanged
displayName
uSNCreated
memberOf
uSNChanged
name
objectGUID
userAccountControl
badPwdCount
codePage
countryCode
badPasswordTime
lastLogoff
lastLogon
pwdLastSet
primaryGroupID
objectSid
accountExpires
logonCount
sAMAccountName
sAMAccountType
userPrincipalName

You may also refer:

• Using LDAP functions to get Active Directory tokenGroups attribute in PHP

Solution 3

AD does not store the password in plain text. The password hash is stored in unicodePwd. This attribute can be only retrieved using ldapi interface. The regular ldap_search will not return anything.

Comments

[wimvds]

You will not be able to get (as in read) a password from AD, you can however authenticate someone (ie. check if a given user/password combo has a match in AD).