[PEAR-BUG] Req #16796 [Asn->Opn]: Support deletion of non-queried attributions

Edit report at http://pear.php.net/bugs/bug.php?id=16796&edit=1

 ID:               16796
 Updated by:       [email protected]
 Reported By:      candrews at integralblue dot com
 Summary:          Support deletion of non-queried attributions
-Status:           Assigned
+Status:           Open
 Type:             Feature/Change Request
 Package:          Net_LDAP2
 Package Version:  2.0.7
 PHP Version:      5.2.5
 Assigned To:      beni
 Roadmap Versions: 
 New Comment:

-Status: Assigned
+Status: Open



Previous Comments:
------------------------------------------------------------------------

[2010-03-23 08:50:58] beni

The problem here seems, that Net_LDAP2 does not see the old password
value and so thinks, the attribute is empty.

Please try to force the replacement when calling replace():
$force = true;
$entry->replace(..., $force);


You could also try the following:
- set up a "fresh" entry with the corresponding password values
- mark the entry as existing
- perform the password replacement

<?php
$dn      = $oldentry->dn();
$oldpw = 'foo1234';
$newpw = '1234foo';

$entry = Net_LDAP2_Entry::createExisting($dn, array('unicodePwd' =>
$oldpw));
$entry->setLDAP($ldap);
$entry->replace('unicodePwd' => $newpw);
$entry->update();

Does this work too?

------------------------------------------------------------------------

[2009-11-25 15:34:02] beni

Hello,
unfortunately i could not manage to get an AD here, so i cant develop
that fix in the near future.
It would be cool, if you would have a try on it and develop an patch for
this.

------------------------------------------------------------------------

[2009-11-20 07:32:18] beni

Okay, thank you for your feedback.
The main problem now is, that i don't have an AD to test, so i will need
your help on this.
I will dig into the code the next days and try to figure out how to best
deal with this, your suggestions from your first post will be of much
use i think.

Please feel free to bother me next week if i do not respond again, as i
have some projects in hot phases and may forget about my research work
here.

------------------------------------------------------------------------

[2009-11-19 17:19:29] candrews

Yes, I tried it. The name/value delete then name/value add is the only
way for a non-Administrative user to change their password over LDAP
with Active Directory (which makes sense... AD needs the user's old
password to confirm it's validity).

Here's the documentation:
http://msdn.microsoft.com/en-us/library/cc223248%28PROT.10%29.aspx

The replace process works fine - if you bind as an administrator (which
seems bad due to the security implications).

------------------------------------------------------------------------

[2009-11-19 10:48:20] beni

Have you tried this or did you just guess?
As far as i remember, replace() does a one-step replacement of the
attribute.

------------------------------------------------------------------------

The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
    http://pear.php.net/bugs/bug.php?id=16796

-- 
Edit this bug report at http://pear.php.net/bugs/bug.php?id=16796&edit=1