OTN Discussion Forums : Update Active Directory Password ...

ScarKnight

글: 1
등록일: 07-02-21

Update Active Directory Password through DBMS_LDAP call
게시일: Apr 6, 2007 8:44 AM

I have a need to update a user's password in Microsoft's Active Directory through PL/SQL. I have configured an Oracle Wallet and can successfully bind to the Active Directory (LDAP) over SSL Port 636.

However, when I attempt to change the 'unicodePwd' parameter through the DBMS_LDAP.populate_mod_array statement below:

DBMS_LDAP.populate_mod_array(v_emp_array,DBMS_LDAP.MOD_REPLACE,'unicodePwd',v_emp_vals);

I receive the following error:

ORA-31202: DBMS_LDAP: LDAP client/server error: DSA is unwilling to perform. 0000001F: SvcErr: DSID-031A0FC0, problem 5003 (WILL_NOT_PERFORM), data 0
ORA-06512: at "SYS.DBMS_SYS_ERROR", line 86
ORA-06512: at "SYS.DBMS_LDAP", line 1455
ORA-06512: at "SYS.DBMS_LDAP", line 929
ORA-06512: at line 103

Has anyone experienced this before? Is this a problem on the Active Directory configuration, or is there something that may need to be done to the string being passed into the attribute (i.e., needs to be converted to Unicode?). We are attempting to create the Unicode string through the following routine:

v_emp_vals(1) := UTL_RAW.cast_to_raw(convert(v_random_pwd, 'AL16UTF16', 'US7ASCII'));

, but this does not appear to resolve the issue. Any help!?

Mike Slade

글: 3
등록일: 07-07-23

Re: Update Active Directory Password through DBMS_LDAP call
게시일: Jul 23, 2007 9:13 AM

ScarKnight님의 질문에 답변

I am having the same problem. Can you let me know if you were able to find working code to do this?

lfreitas34

글: 106
등록일: 00-08-18

Re: Update Active Directory Password through DBMS_LDAP call
게시일: Jul 24, 2007 8:38 AM

ScarKnight님의 질문에 답변

Hi,

You need to use the little endian Unicode characterset, 'AL16UTF16LE', also the password needs to be concatenated with double quotes on each side:

bervals dbms_ldap.berval_collection;
...
bervals(1) := utl_raw.cast_to_raw(convert('"'||password||'"','AL16UTF16LE'))

It wont work if you are not using a SSL connection to the ActiveDirectory.

Regards,
Luis

Mike Slade

글: 3
등록일: 07-07-23

Re: Update Active Directory Password through DBMS_LDAP call
게시일: Jul 24, 2007 11:39 AM

lfreitas34님의 질문에 답변

Thanks for that code

That will be great when I get the SSL to work, but I can't quite get that to work yet.

LDAP_HOST := '10.64.0.XXX';
LDAP_PORT :='636';

MY_SESSION := DBMS_LDAP.INIT (LDAP_HOST, LDAP_PORT);

RETVAL := DBMS_LDAP.OPEN_SSL(MY_SESSION, 'file:/u01/app/oracle/product/9.0.4/Apache/Apache/conf/ssl.wlt/wilkes/', 'password', 2);

It errors out on the DBMS_LDAP.OPEN_SSL

ORA-31202: DBMS_LDAP: LDAP client/server error: UnKnown Error Encountered

Mike Slade

글: 3
등록일: 07-07-23

Re: Update Active Directory Password through DBMS_LDAP call
게시일: Jul 25, 2007 8:10 AM

Mike Slade님의 질문에 답변

Update

I had the certificate installed on the database server to make sure it wasn't having problems finding it.

Reading the other posts I found a sample select to try

SELECT UTL_HTTP.REQUEST('HTTPS://INTERACT.CSC.XXX.XXX:4443/....',
NULL,'FILE:/U11/APP/ORACLE/ADMIN/TST7/CERTIFICATE','pswrd')
FROM DUAL;

This worked successfully, but I am still getting the same error on the open_ssl function.

lfreitas34

글: 106
등록일: 00-08-18

Re: Update Active Directory Password through DBMS_LDAP call
게시일: Jul 31, 2007 9:41 AM

Mike Slade님의 질문에 답변

This "Unknown error encountered" message is really annoying. I have seen this only on 10g release 2. If you try with a older release it gives a NZE layer error that you can lookup on metalink. NZE is the Oracle SSL implementation.

For the SSL connection to work you only need to import the CA certificate into the wallet as a trusted certificate. If you open the certificate in Windows you can see the CA certificate on the last tab, "Certification Path". Usually in a windows network the CA certificate is installed automatically in Internet Explorer on the workstations. If there is a certificate chain you likely have to import all intermediate certificates too.

There is really not much else to it. I used ldapbind to test the wallet:

ldapbind -D user@domain.path -w password -U 2 -h
adserverhost -p 636 -W file:/oracle/wallet -P walletpwd

For mode 2 you need a user and password.

I had a problem with certificates with a null subject name field. AD seems to generate a null subject name for some certificate types and the Oracle implementation currently does not like this.

Regards.

Michael Geier

글: 18
등록일: 06-08-24

Re: Update Active Directory Password through DBMS_LDAP call
게시일: Sep 21, 2007 11:53 AM

Mike Slade님의 질문에 답변

See Metalink 215532.1
"The Oracle Extensions to the LDAP APIs (DBMS_LDAP_UTL and C API SSL extension) cannot be used with third party directories."

My interpretation of this is that using DBMS_LDAB.open_ssl is not supported with anything besides OID. And any other product of Oracle's that does allow for third-party directory authentication is probably not using DBMS_LDAP, but something more low-level.

lfreitas34

글: 106
등록일: 00-08-18

Re: Update Active Directory Password through DBMS_LDAP call
게시일: Sep 23, 2007 10:49 AM

Michael Geier님의 질문에 답변

Yeah, you are right. Actually, DBMS_LDAP not supported with anything besides OID. Not even DBMS_LDAP.INIT.

Even with the Active Directory authentication plugins on the 10.1.2 version being PL/SQL based, using DBMS_LDAP, and able to connect either with or without SSL, use of DBMS_LDAP for custom code with any third party directory is not supported.

So if you have any trouble you will need to reproduce it with other tools, like ldapbind or ldapmodify. Or reproduce the issue using OID.

user605362

글: 1
등록일: 07-11-13

Re: Update Active Directory Password through DBMS_LDAP call
게시일: Nov 13, 2007 12:44 PM

lfreitas34님의 질문에 답변

I got to work today. The trick is to make sure you use a binary collection to put the password in. Of course this assumes you are using SSL. as well. I was just a few minutes from giving up when figured it out.

ldap_valsb DBMS_LDAP.BERVAL_COLLECTION ;

ldap_valsb(1) := UTL_RAW.cast_to_raw(convert('"' || :new.lpass || '"','AL16UTF16LE'));
ldap_adduserstring := ldap_adduserstring || ' *UNICODEPWD:' || ldap_valsb(1);
DBMS_LDAP.populate_mod_array(ldap_array,DBMS_LDAP.MOD_ADD , 'unicodePwd',ldap_valsb);

motikem

글: 4
등록일: 07-11-20

Re: Update Active Directory Password through DBMS_LDAP call
게시일: Nov 20, 2007 12:37 PM

ScarKnight님의 질문에 답변

I'm having the same exact problem. My stored procedure is returning this error:

The error code is -31202-ORA-31202: DBMS_LDAP: LDAP client/server error: DSA is unwilling to perform. 0000001F: SvcErr: DSID-031A0FC0, problem 5003 (WILL_NOT_PERFORM), data 0

I have done the following:

1. Successfully connected to my AD Server using Secure LDAP (port 636)
2. Cast the input password to a raw datatype:
UTC_passwd := UTL_RAW.cast_to_raw(convert('"' || I_NEWPWD || '"','AL16UTF16LE'));
3. Populating the mod array using DBMS_LDAP.create_mod_array and executing the mod:

-- Modify Attribute
emp_array := DBMS_LDAP.create_mod_array(1);
emp_vals(1) := UTC_passwd;

-- Modify Attribute Password
DBMS_LDAP.populate_mod_array(emp_array,DBMS_LDAP.MOD_REPLACE,'unicodePwd',emp_vals);
emp_dn := 'cn='||I_USERNAME||',ou=Users,' || ldap_base;

chgresult := DBMS_LDAP.modify_s(my_session,emp_dn,emp_array);

It doesn't appear that anyone answered the question as to whether this is a problem with AD or a problem with the Oracle procedure. Has anyone actually gotten this to work? If so, are you willing to share your code, or at least tell me what I'm doing wrong here? I can post a full listing if it will help.

lfreitas34

글: 106
등록일: 00-08-18

Re: Update Active Directory Password through DBMS_LDAP call
게시일: Nov 21, 2007 9:02 AM

motikem님의 질문에 답변

This error seems to be from AD. And your code seems ok to me. To change the password using only the new password you need to do it using an administrative account. If you are changing your own password you need to use a replace operation and send the old password and the new password.

Also, are you sure that your users are in the form 'cn='||I_USERNAME||',ou=Users,' || ldap_base on Active Directory? The cn does not need to be equal to the samaccountname (Or the uid you see on OID).

Regards,
Luis

motikem

글: 4
등록일: 07-11-20

Re: Update Active Directory Password through DBMS_LDAP call
게시일: Dec 3, 2007 9:30 AM

lfreitas34님의 질문에 답변

It turns out I did make a mistake. I had to use the DBMS_LDAP.BERVAL_COLLECTION data type to store the passwords. Once I made the emp_vals array a BERVAL, the password change worked correctly - using an administrator account in AD. There seem to be a couple of quirks though:

-Upon changing a user's password, AD still allows access under that user's account with the user's old password, via LDAP. However, upon domain login, AD does not allow the old password and actually eliminates the ability to login to AD via LDAP with the old password.

-I'm attempting to update the code to use the user's own account to effect the password change. This is a bit more complicated than using an administrator account. It requires two operations in the mod_array. The first one is a MOD_DELETE of the old password, the second is a MOD_ADD of the new password.

I can post a working listing of the code that allows this password change if anyone is interested.

fla

글: 2
등록일: 07-12-07

Re: Update Active Directory Password through DBMS_LDAP call
게시일: Dec 7, 2007 12:33 AM

motikem님의 질문에 답변

Hello,
I'm trying to set AD password to a new entry user.
I know i have to use SSL, an administrator account, but no more.
Can you post a working listing of the code?

Thank you...

fla

글: 2
등록일: 07-12-07

Re: Update Active Directory Password through DBMS_LDAP call
게시일: Dec 7, 2007 12:34 AM

motikem님의 질문에 답변

Hello,
I'm trying to set AD password to a new entry user.
I know i have to use SSL, an administrator account, but no more.
Can you post a working listing of the code?

Thank you...

user610854

글: 1
등록일: 07-12-17

Re: Update Active Directory Password through DBMS_LDAP call
게시일: Dec 17, 2007 1:34 AM

fla님의 질문에 답변

Hi,

Some of you have mentioned that you could successfully use Port 636 for binding a session to AD thru SSL using dbms_ldap.open_ssl

Some of the metalink note suggests that using SSL to connect to a thirdparty LDAP is not supported in dbms_ldap. Is it true?

How did you do bind then? Using wallet? What are the steps for creating wallet... Could you pls provide the steps / any URL explaining how to do this.