OpenLDAP And ActiveDirectory

[sumoo13]

Hello,

Je suis en train d'essayer de faire un instalation de Self-service-password.
Je me demande s'il est possible de configurer un openLDAP et un ActiveDirectory ?
Je suis en train de faire le fichier de configuration, et j'ai l'impression que c'est l'un ou l'autre et non pas l'un ET l'autre ?

Nous avons les deux annuaires, on aimerait pouvoir changer le mot de passe dans les deux annuaires !

Est ce possible ?

merci pour vos retours

[coudot]

Hello,

configure with OpenLDAP ans then use the posthook script to forward the password to Active Directory : https://self-service-password.readthedocs.io/en/v1.4/config_preposthook.html

[sumoo13]

oh nice !

sorry, I hadn't gone that far in the configuration yet :/

where should we use $posthook = "php /usr/share/self-service-password/myscript.php $login $newpassword";

or can we call it directly with $posthook = "/usr/share/self-service-password/myscript.php" with a GET or a POST?

[coudot]

Configure $posthook in the configuration file, the value is the commande, no need to add args, they are set by the code:

$posthook = "php /usr/share/self-service-password/myscript.php";

[sumoo13]

thank's i try it

[sumoo13]

it's perfect ! work fine, my php call a powershell script for reset pwd in AD and AAD

[coudot]

Interesting, maybe you could share this powershell script?

[sumoo13]

powersheel is installed on the debian server but is a lowcost powershell, i use it to call another ps1 script on the windows server

in myscrpt.php :(the $mail is get with a ldap request)
$uid = $argv[1]; $newpassword = base64_decode($argv[2]); $mail = getMail($uid), $output = shell_exec('pwsh /usr/share/self-service-password/scripts/chng_pwd.ps1 '.$mail.' '.$uid.' '.$newpassword);

in myscript.ps1

$PassKey = [byte]0000000000000000000000000000000000000
$Password = Get-Content /usr/share/self-service-password/scripts/key | Convertto-SecureString -Key $PassKey
$Username = "Admin"

$Credentials  = New-Object System.Management.Automation.PSCredential $Username, $Password 

$mail=$args[0]
$uid=$args[1]
$newpassword=$args[2]

Invoke-Command -ComputerName 192.168.235.5 -Authentication Negotiate -Credential $Credentials -ScriptBlock {Powershell.exe  -nologo -executionpolicy Bypass -Command "& 'C:\scripts\chg_ss_pwd.ps1' $args[0] $args[1] $args[2]"} -ArgumentList $mail,$uid,$newpassword,"dbg"

"dbg" it's for debug

chg_ss_pwd.ps1 on windows server

Get-PSSession | Remove-PSSession

$PassKey = [byte]0000000000000000000000000000000000000000000000000
$Office365Password = Get-Content Key | Convertto-SecureString -Key $PassKey
$Office365Username = "[email protected]"

$Office365Credentials  = New-Object System.Management.Automation.PSCredential $Office365Username, $Office365Password 

Connect-MsolService -Credential $Office365Credentials
Connect-ExchangeOnline -Credential $Office365Credentials -ShowProgress $true

$username = "domaine\admin"  	
$password = Get-Content KeyAD | Convertto-SecureString -Key $PassKey
$Cred = New-Object System.Management.Automation.PSCredential $username, $password


#définition et creation des variables
$EmailAcc = $args[0]
$login = $args[1]
$MotdePass = $args[2]
if ($login.Length -gt 20) {
	$uid = $login.Substring(0,20)
}else {
	$uid = $login
}

Set-MsolUserPassword -UserPrincipalName $EmailAcc -NewPassword $MotdePass -ForceChangePassword $false

Set-ADAccountPassword -Identity $uid -Reset -NewPassword (ConvertTo-SecureString -AsPlainText $MotdePass -Force -Verbose) -Credential $Cred  –PassThru

Get-PSSession | Remove-PSSession

good page for help : PowerShell Remoting from Linux to Windows

[coudot]

Very interesting, thanks a lot!