<?php

/* how to change your active directory password with php
   n.b. your ad controllers have to support ldaps via TLS or SSL on port 636
   easiest way is to roll out ad certificate services */

$LDAP_SERVER = "192.168.23.42";
$LDAP_BASEDN = "dc=your_domain,dc=invalid";
$LDAP_USER   = "user@your_domain.invalid";
$LDAP_OLDPW  = "secret";
$LDAP_NEWPW  = "moarsecret";

putenv('LDAPTLS_REQCERT=never');

$conn = ldap_connect("ldaps://" . $LDAP_SERVER);
if (!$conn) die("can't connect\n");

ldap_set_option($conn, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($conn, LDAP_OPT_REFERRALS, FALSE);

if (!ldap_bind($conn, $LDAP_USER, $LDAP_OLDPW)) die("can't bind\n");

$filter = "(userPrincipalName=" . $LDAP_USER . ")";
$result = ldap_search($conn, $LDAP_BASEDN, $filter, array(), 1);
if (!$result) die("can't search\n");

$count = ldap_count_entries($conn, $result);
if ($count !== 1) die("need exactly 1 search result, not " . $count . "\n");

$entry = ldap_first_entry($conn, $result);
if (!$entry) die("empty first entry\n");

$dn = ldap_get_dn($conn, $entry);
if (!$dn) die("entry has no dn\n");

$info = array(array(
  "attrib" => "unicodePwd",
  "modtype" => LDAP_MODIFY_BATCH_REMOVE,
  "values"  => array(iconv("UTF-8", "UTF-16LE", '"' . $LDAP_OLDPW . '"')),
), array(
  "attrib" => "unicodePwd",
  "modtype" => LDAP_MODIFY_BATCH_ADD,
  "values"  => array(iconv("UTF-8", "UTF-16LE", '"' . $LDAP_NEWPW . '"')),
));

if (!ldap_modify_batch($conn, $dn, $info)) die("can't modify\n");

if (!ldap_unbind($conn)) die("can't unbind\n");

?>