LDAP to change user password

Question

As I know, in PHP, we need to connect LDAP over SSL in order to change user password.

Is there another way, E.G, other language (JAVA / ASP) to change LDAP password without SSL required?

Thanks.

Updates: I get "Warning: ldap_mod_replace() [function.ldap-mod-replace]: Modify: Insufficient access" when I try to modify self account password. If i try to change other user password, I get no error message, but the password still stick to the old one.

Answer 1

Many LDAP implementations do indeed require SSL or TLS in order to change/set passwords. This is a requirement set by the LDAP server, not the language used to access it. Changing languages will not permit you to override this particular server requirement.

I understand that there are extenuating circumstances where you may not be able to establish a SSL/TLS connection, but in general, you absolutely want to be encrypting password functions like this - even if the server doesn't require it.

Edit: I bet the answer can be founds in the slapd logs. Also worth reviewing the ACLs: OpenLDAP Software 2.4 Administrator's Guide, Section 8. Access Control.

Answer 2

The directory stores password values in the userPassword attribute of the user entry. Depending on the access control settings for the server, users may set the value of userPassword in accordance with the password policy you specify, using standard tools, such as ldapmodify for example.

ldapmodify -h host -p port -D "cn=Directory Manager" -w password
dn: uid=bjensen,ou=People,dc=example,dc=com
changetype: modify
replace: userPassword
userPassword: ChAnGeMe