Add exopPassword change suport for argon2

Author: Ph0tonic

src/Ldap.php

@@ -313,6 +313,16 @@ public function saslBind(?string $dn = null, ?string $password = null, array $op
         });
     }
 
+    /**
+     * {@inheritdoc}
+     */
+    public function exopPasswd(string $dn, string $oldPassword, string $newPassword): bool
+    {
+        return $this->executeFailableOperation(function () use ($dn, $oldPassword, $newPassword) {
+            return (bool) ldap_exop_passwd($this->connection, $dn, $oldPassword, $newPassword);
+        });
+    }
+
     /**
      * {@inheritdoc}
      */

src/LdapInterface.php

@@ -519,6 +519,15 @@ public function bind(?string $dn = null, ?string $password = null, ?array $contr
      */
     public function saslBind(?string $dn = null, ?string $password = null, array $options = []): bool;
 
+    /**
+     * Change a password using the LDAP Password Modify extended operation (RFC 3062).
+     *
+     * @see https://www.php.net/manual/en/function.ldap-exop-passwd.php
+     *
+     * @throws LdapRecordException
+     */
+    public function exopPasswd(string $dn, string $oldPassword, string $newPassword): bool;
+
     /**
      * Adds an entry to the current connection.
      *

src/Models/Attributes/Password.php

@@ -244,6 +244,14 @@ public static function getSalt(string $encryptedPassword): string
         throw new LdapRecordException('Could not extract salt from encrypted password.');
     }
 
+    /**
+     * Determine if the hash method requires the LDAP Password Modify extended operation (RFC 3062).
+     */
+    public static function hashMethodRequiresExop(string $method): bool
+    {
+        return in_array(strtolower($method), ['argon2i', 'argon2id']);
+    }
+
     /**
      * Determine if the hash method requires a salt to be given.
      *

src/Models/Concerns/HasPassword.php

@@ -10,6 +10,43 @@
 /** @mixin Model */
 trait HasPassword
 {
+    /**
+     * Pending argon2 password change to be executed on save via RFC 3062 extended operation.
+     *
+     * @var array{0: string, 1: string}|null
+     */
+    protected ?array $pendingPasswordExopChange = null;
+
+    /**
+     * Execute any pending argon2 password change via exop, then process remaining modifications.
+     */
+    protected function performUpdate(): void
+    {
+        if ($this->pendingPasswordExopChange === null) {
+            parent::performUpdate();
+
+            return;
+        }
+
+        [$oldPassword, $newPassword] = $this->pendingPasswordExopChange;
+
+        $this->pendingPasswordExopChange = null;
+
+        $modifications = $this->getModifications();
+
+        $this->dispatch('updating');
+
+        $this->setChangedPasswordViaExop($oldPassword, $newPassword);
+
+        if (count($modifications)) {
+            $this->newQuery()->update($this->dn, $modifications);
+        }
+
+        $this->dispatch('updated');
+        $this->syncChanges();
+        $this->syncOriginal();
+    }
+
     /**
      * Set the password on the user.
      *
@@ -29,17 +66,14 @@ public function setPasswordAttribute(array|string $password): void
         // If the password given is an array, we can assume we
         // are changing the password for the current user.
         if (is_array($password)) {
-            if (in_array(strtolower($method), ['argon2i', 'argon2id'])) {
-                throw new LdapRecordException(
-                    "Argon2 passwords cannot be changed using this method. Use the LDAP Password Modify extended operation instead."
-                );
-            }
-
-            $this->setChangedPassword(
-                $this->getHashedPassword($method, $password[0], $this->getPasswordSalt($method)),
-                $this->getHashedPassword($method, $password[1]),
-                $this->getPasswordAttributeName()
-            );
+            match (true) {
+                Password::hashMethodRequiresExop($method) => $this->pendingPasswordExopChange = [$password[0], $password[1]],
+                default => $this->setChangedPassword(
+                    $this->getHashedPassword($method, $password[0], $this->getPasswordSalt($method)),
+                    $this->getHashedPassword($method, $password[1]),
+                    $this->getPasswordAttributeName()
+                ),
+            };
         }
         // Otherwise, we will assume the password is being
         // reset, overwriting the one currently in place.
@@ -125,6 +159,24 @@ protected function setChangedPassword(string $oldPassword, string $newPassword,
         );
     }
 
+    /**
+     * Change the password using the LDAP Password Modify extended operation (RFC 3062).
+     *
+     * @throws LdapRecordException
+     */
+    protected function setChangedPasswordViaExop(string $oldPassword, string $newPassword): void
+    {
+        if (! $this->exists || ($dn = $this->getDn()) === null) {
+            throw new LdapRecordException(
+                'Cannot change password on a model that does not exist in the directory.'
+            );
+        }
+
+        $this->getConnection()
+            ->getLdapConnection()
+            ->exopPasswd($dn, $oldPassword, $newPassword);
+    }
+
     /**
      * Set the password on the model.
      */

src/Testing/LdapFake.php

@@ -418,6 +418,14 @@ public function parseResult(mixed $result, int &$errorCode = 0, ?string &$dn = n
             : new LdapResultResponse;
     }
 
+    /**
+     * {@inheritdoc}
+     */
+    public function exopPasswd(string $dn, string $oldPassword, string $newPassword): bool
+    {
+        return $this->resolveExpectation(__FUNCTION__, func_get_args());
+    }
+
     /**
      * {@inheritdoc}
      */

tests/Unit/Models/OpenLDAP/UserTest.php

@@ -4,9 +4,10 @@
 
 use LdapRecord\Connection;
 use LdapRecord\Container;
-use LdapRecord\LdapRecordException;
 use LdapRecord\Models\Attributes\Password;
 use LdapRecord\Models\OpenLDAP\User;
+use LdapRecord\Testing\DirectoryFake;
+use LdapRecord\Testing\LdapFake;
 use LdapRecord\Tests\TestCase;
 
 class UserTest extends TestCase
@@ -76,18 +77,29 @@ public function test_algo_and_salt_is_automatically_detected_when_changing_a_use
         $this->assertEquals(Password::CRYPT_SALT_TYPE_SHA512, $newAlgo);
     }
 
-    public function test_changing_argon2_password_throws_exception()
+    public function test_changing_argon2_password_uses_exop()
     {
-        $this->expectException(LdapRecordException::class);
-        $this->expectExceptionMessage('Argon2 passwords cannot be changed using this method.');
-
-        $user = (new OpenLDAPUserTestStub)->setRawAttributes([
-            'userpassword' => [
-                Password::argon2id('secret'),
-            ],
+        DirectoryFake::setup()
+            ->getLdapConnection()
+            ->expect([
+                LdapFake::operation('isUsingTLS')->once()->andReturnTrue(),
+                LdapFake::operation('exopPasswd')->once()->with(
+                    fn ($dn) => $dn === 'cn=john,dc=local,dc=com',
+                    fn ($old) => $old === 'secret',
+                    fn ($new) => $new === 'new-secret',
+                )->andReturnTrue(),
+            ]);
+
+        $user = new User;
+
+        $user->setRawAttributes([
+            'userpassword' => [Password::argon2id('secret')],
+            'dn' => ['cn=john,dc=local,dc=com'],
         ]);
 
         $user->password = ['secret', 'new-secret'];
+
+        $user->save();
     }
 
     public function test_correct_auth_identifier_is_returned()