Enforcing Active Directory password history when resetting passwords using PHP

The code:

$ctrl1 = array(
    // LDAP_SERVER_POLICY_HINTS_OID for Windows 2012 and above
    "oid" => "1.2.840.113556.1.4.2239",
    "value" => sprintf("%c%c%c%c%c", 48, 3, 2, 1, 1));
$ctrl2 = array(
    // LDAP_SERVER_POLICY_HINTS_DEPRECATED_OID for Windows 2008 R2 SP1 and above
    "oid" => "1.2.840.113556.1.4.2066",
    "value" => sprintf("%c%c%c%c%c", 48, 3, 2, 1, 1));
if (!ldap_set_option($ds, LDAP_OPT_SERVER_CONTROLS, array($ctrl1, $ctrl2))) {
    error_log("ERROR: Failed to set server controls");
}

$result = ldap_mod_replace($ds, $dn, $entry);
...

Details:

There are a couple of ways to reset Active Directory passwords using LDAP:

1. A delete operation on the unicodePwd attribute immediately followed by an add, which is a password change


2. A modification of the unicodePwd attribute, which is considered an administrative password reset

When doing the latter, password history requirements may not be enforced. Apparently this is expected behavior. The solution is a server control:

1. First, the control must be available on the server. It's present in Windows Server 2008 R2 Service Pack 1 and above. It can also be installed in 2008 R2 using this hotfix: http://support.microsoft.com/?id=2386717


2. Next, the client must use the control to tell the AD server to enforce password history requirements.

If you happen to be doing this in PHP, the solution for the second part is the code I've posted. The tricky part was to get the BER encoding for the value correct.

I put both controls (the new one as well as the deprecated one) in my code and also didn't set the iscritical flag (which defaults to false) in order to make the code as flexible as possible.

In case you're looking to implement a solution to reset AD passwords using PHP, you may find these helpful:

• http://stackoverflow.com/q/10763070/399105
• http://windows.ittoolbox.com/groups/technical-functional/activedirectory-l/using-ldap_mod_replace-to-change-unicodepwd-attribute-for-ad-user-account-3809574
• http://www.letu.edu/people/markroedel/netcccu/activedirectorypasswordchanges.htm

PHP trim/strip non-breaking space

I was just writing some PHP and having the hardest time getting rid of a non-breaking space ( ) character in some HTML I was parsing.  I finally figured it out:  the page was encoded in UTF-8, and the encoding for a non-breaking space is 0xC2 0xA0.  This is the code that finally did the trick (I also had to get rid of carriage return characters, hence the “\n”):

$string = trim( $string, "\xC2\xA0\n" );