feat(password-recovery): Add LDAP password recovery

Documentation/SOGoInstallationGuide.asciidoc

@@ -787,7 +787,7 @@ authentication and global address books. Multiple sources can be
 specified as an array of dictionaries.
 
 |S |SOGoPasswordRecoveryEnabled
-|Boolean enable password recovery with secret question or secondary e-mail. Only for database user source.
+|Boolean enable password recovery with secret question or secondary e-mail.
 
 |S |SOGoPasswordRecoveryDomains
 |List of domains where password recovery is enabled. If empty, enabled for all domains

SoObjects/SOGo/LDAPSource.m

@@ -708,6 +708,39 @@ groupObjectClasses: (NSArray *) newGroupObjectClasses
   return didChange;
 }
 
+- (BOOL)  _ldapAdminModifyAttribute: (NSString *) theAttribute
+                     withValue: (NSString *) theValue
+                        userDN: (NSString *) theUserDN
+                    connection: (NGLdapConnection *) bindConnection
+{
+  NGLdapModification *mod;
+  NGLdapAttribute *attr;
+  NSArray *changes;
+
+  BOOL didChange;
+
+  attr = [[NGLdapAttribute alloc] initWithAttributeName: theAttribute];
+  [attr addStringValue: theValue];
+
+  mod = [NGLdapModification replaceModification: attr];
+
+  changes = [NSArray arrayWithObject: mod];
+
+  if ([bindConnection bindWithMethod: @"simple"
+                              binddn: _bindDN
+                         credentials: _password])
+    {
+      didChange = [bindConnection modifyEntryWithDN: theUserDN
+                                            changes: changes];
+    }
+  else
+    didChange = NO;
+
+  RELEASE(attr);
+
+  return didChange;
+}
+
 /**
  * Change a user's password.
  * @param login the user's login name.
@@ -787,20 +820,38 @@ groupObjectClasses: (NSArray *) newGroupObjectClasses
 
                     if (encryptedPass != nil)
                       {
-                        if ([bindConnection bindWithMethod: @"simple"
+                        if (!passwordRecovery) {
+                          if ([bindConnection bindWithMethod: @"simple"
                                                     binddn: userDN
                                                credentials: oldPassword])
-                          {
-                            didChange = [self _ldapModifyAttribute: @"userPassword"
-                                                         withValue: encryptedPass
-                                                            userDN: userDN
-                                                          password: oldPassword
-                                                        connection: bindConnection];
-                            if (didChange)
                               {
-                                *perr = PolicyNoError;
+                                didChange = [self _ldapModifyAttribute: @"userPassword"
+                                                            withValue: encryptedPass
+                                                                userDN: userDN
+                                                              password: oldPassword
+                                                            connection: bindConnection];
+                                if (didChange)
+                                  {
+                                    *perr = PolicyNoError;
+                                  }
                               }
-                          }
+                        } else {
+                          // Password recovery
+                          // As old password is unknown, we use admin binding
+                          if ([bindConnection bindWithMethod: @"simple"
+                                                      binddn: _bindDN
+                                                 credentials: _password])
+                              {
+                                didChange = [self _ldapAdminModifyAttribute: @"userPassword"
+                                                                  withValue: encryptedPass
+                                                                     userDN: userDN
+                                                                 connection: bindConnection];
+                                if (didChange)
+                                  {
+                                    *perr = PolicyNoError;
+                                  }
+                              }
+                        }
                       }
                   }
 

UI/WebServerResources/js/Main/Main.app.js

@@ -153,9 +153,7 @@
     this.restoreLogin = function() {
       vm.loginState = false;
       delete vm.creds.verificationCode;
-      if (vm.isInPasswordRecoveryMode()) {
-        vm.passwordRecoveryAbort();
-      }
+      vm.passwordRecoveryAbort();
     };
 
     this.continueLogin = function() {