change password with python-ldap

Question

I want change password on ldap user. The script is:

def changePassword(url,binddn,pw, newpw):
l = ldap.initialize(url)
ldap.
try:
    l.protocol_version=ldap.VERSION3
    l.simple_bind_s(binddn,pw)
except:
    print "Error Bind in changePassword"
    sys.exit(0)

old = {'userPassword':pw}
new = {'userPassword':newpw}
ldif = modlist.modifyModlist(old,new)
try:
    l.modify_s(binddn,ldif)
    l.unbind_s()
except:
    print "error"

But when I call this function, I receive "error". My LDAP has PPolicy for require current password when I change password.

How to change password whit this PPolicy??

Can anyone help me??

Thanks in advance Dario

Answer 1

With an LDAPv3 server, you should generally never do a direct mod/replace on a user password, and instead use the LDAPv3 Password modify operation. Using python-ldap, this is done with passwd/passwd_s. For example:

import ldap
server = 'localhost'
l = ldap.initialize('ldap://%s' % server)
l.simple_bind_s("cn=Marice McCaugherty,ou=Product Testing,dc=example,dc=com", "ytrehguaCc")
l.passwd_s("cn=Marice McCaugherty,ou=Product Testing,dc=example,dc=com", "ytrehguaCc", "secret")

Would bind as the user DN listed, and change their password from "ytrehguaCc" to "secret".