Active Directory password change

I’m trying to write a script which will allow users to change their own passwords on Active Directory. After a successful bind as the user with their ‘old’ password, I’m using:

client.modify(userDN, [
    new ldap.Change({
        operation: 'delete',
        modification: {
            unicodePwd: encodePassword(oldPassword)
        }
    }),
    new ldap.Change({
        operation: 'add',
        modification: {
            unicodePwd: encodePassword(newPassword)
        }
    })
], function(err) {
    if (err) {
        console.log(err.dn);
        console.log(err.code);
        console.log(err.name);
        console.log(err.message);
        client.unbind();
    }
    else {
        console.log('Password changed!');
    }
});

Where encodePassword is defined as

function encodePassword(password) {
    var newPassword = '';
    password = '"' + password + '"';
    for (var i = 0; i < password.length; i++) {
        newPassword += password[i] + "\000";
    }
    return new Buffer(newPassword).toString('base64');
}

which was taken from http://www.cs.bham.ac.uk/~smp/resources/ad-passwds/

The PHP script + ldapmodify works fine but the Node.js script gives a ConstraintViolationError with the message

0000216C: AtrErr: DSID-03190EB0, #1:
    0: 0000216C: DSID-03190EB0, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 9005a (unicodePwd)

The new password meets the constraints applied by the server (complexity etc) so I’m not sure what’s going wrong. As the password change can only be done over ldaps I can’t provide a Wireshark capture and I’m out of ideas. Any suggestions?

[PhilWaldmann]

To change the password of an ActiveDirectory user you’ll need the following things:

1. ldaps connection with valid certificate installed on the AD Server
2. successful ldap bind
3. proper rights to change the pw
4. and utf16le encoded password in quotes

I’m using the following function to get the encoded password.

convertPassword: function(str){
    var output = '';
    str = '"' + str + '"';

    for(var i = 0; i < str.length; i++){
      output += String.fromCharCode( str.charCodeAt(i) & 0xFF,(str.charCodeAt(i) >>> 8) & 0xFF);
    }

    return output;
  } 

[ghost]

function encodePassword(password) {
    return new Buffer('"' + password + '"', 'utf16le').toString();
}

This works.