docker exec self-service-password-182-web grep -m1 'version' /var/www/htdocs/index.php

$version = "1.8.2";

docker exec self-service-password-182-openldap slapd -V

@(#) $OpenLDAP: slapd 2.4.57+dfsg-1~bpo10+1 (Jan 30 2021 06:59:51) $

name: self-service-password-182-stack
services:
  openldap:
    image: osixia/openldap:latest
    container_name: self-service-password-182-openldap
    hostname: openldap
    environment:
      LDAP_ORGANISATION: "Example Org"
      LDAP_DOMAIN: "example.org"
      LDAP_BASE_DN: "dc=example,dc=org"
      LDAP_ADMIN_PASSWORD: "q1w2e3r4"
      LDAP_CONFIG_PASSWORD: "q1w2e3r4"
      LDAP_RFC2307_SCHEMA: "false"
    volumes:
      - ./openldap/ldif:/container/service/slapd/assets/config/bootstrap/ldif/custom:ro
    command: ["--copy-service"]
    networks:
      - sspnet

  ssp:
    image: ltbproject/self-service-password:1.8.2
    container_name: self-service-password-182-web
    ports:
      - "8138:80"
    volumes:
      - ./ssp/config.inc.local.php:/var/www/conf/config.inc.local.php:ro
    depends_on:
      - openldap
    networks:
      - sspnet

  mailsink:
    image: axllent/mailpit:v1.31.6
    container_name: self-service-password-182-mailsink
    hostname: mailsink
    environment:
      MP_SMTP_AUTH_ACCEPT_ANY: "1"
      MP_SMTP_AUTH_ALLOW_INSECURE: "1"
    networks:
      - sspnet

networks:
  sspnet:
    name: self-service-password-182-net
    driver: bridge
    ipam:
      config:
        - subnet: 10.89.76.0/24

dn: ou=people,dc=example,dc=org
objectClass: organizationalUnit
ou: people

dn: ou=services,dc=example,dc=org
objectClass: organizationalUnit
ou: services

dn: uid=alice,ou=people,dc=example,dc=org
objectClass: inetOrgPerson
uid: alice
cn: Alice
sn: Wang
mail: alice@example.org
mobile: 13800000001
userPassword: q1w2e3r4

dn: uid=bob,ou=people,dc=example,dc=org
objectClass: inetOrgPerson
uid: bob
cn: Bob
sn: Li
mail: bob@example.org
mobile: 13800000002
userPassword: q1w2e3r4

dn: olcDatabase={1}mdb,cn=config
changetype: modify
delete: olcAccess
-
add: olcAccess
olcAccess: to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break
olcAccess: to attrs=userPassword,shadowLastChange by self write by dn="cn=admin,dc=example,dc=org" write by anonymous auth by * none
olcAccess: to attrs=info,objectClass by self write by dn="cn=admin,dc=example,dc=org" write by * none
olcAccess: to * by self read by dn="cn=admin,dc=example,dc=org" write by * none

docker compose up -d

 Network self-service-password-182-net Created
 Container self-service-password-182-openldap Created
 Container self-service-password-182-mailsink Created
 Container self-service-password-182-web Created
 Container self-service-password-182-mailsink Started
 Container self-service-password-182-openldap Started
 Container self-service-password-182-web Started

docker compose ps --format '{{.Name}} {{.Status}}'

self-service-password-182-mailsink Up 16 seconds (healthy)
self-service-password-182-web Up About a minute
self-service-password-182-openldap Up About a minute

PHP Fatal error:  Uncaught Error: Call to undefined function socket_create() in /work/smtp_sink.php:7

ldapsearch -x -H ldap://localhost -b dc=example,dc=org -D cn=admin,dc=example,dc=org -w q1w2e3r4 '(uid=*)' uid mail

dn: uid=alice,ou=people,dc=example,dc=org
uid: alice
mail: alice@example.org

dn: uid=bob,ou=people,dc=example,dc=org
uid: bob
mail: bob@example.org

# numEntries: 2

olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break
olcAccess: {1}to attrs=userPassword,shadowLastChange by self write by dn="cn=admin,dc=example,dc=org" write by anonymous auth by * none
olcAccess: {2}to attrs=info,objectClass by self write by dn="cn=admin,dc=example,dc=org" write by * none
olcAccess: {3}to * by self read by dn="cn=admin,dc=example,dc=org" write by * none

curl -s -o /tmp/ssp_page.html -w 'http=%{http_code} size=%{size_download}\n' http://localhost:8138/
grep -o '<title>[^<]*</title>' /tmp/ssp_page.html

http=200 size=4084
<title>Self service password</title>

curl -s -c /tmp/ssp_a.jar -o /dev/null 'http://localhost:8138/index.php?action=change'
curl -s -b /tmp/ssp_a.jar -o /tmp/t1_weak.html \
  -d 'login=alice' --data-urlencode 'oldpassword=q1w2e3r4' \
  --data-urlencode 'newpassword=abc123' --data-urlencode 'confirmpassword=abc123' \
  'http://localhost:8138/index.php?action=change'

Your password does not have enough special characters

RESULT: Your password was changed

userPassword:: e1NTSEF9cGVBNks4bDBHanhKbVVlL21sRmFCcTQyaER6MFUvZFk=

ldapwhoami -x -H ldap://localhost -D uid=alice,ou=people,dc=example,dc=org -w q1w2e3r4

ldap_bind: Invalid credentials (49)

ldapwhoami -x -H ldap://localhost -D uid=alice,ou=people,dc=example,dc=org -w 'N3wPass!2026'

dn:uid=alice,ou=people,dc=example,dc=org

total: 1
TO: alice@example.org | SUBJ: Your password has been changed

RESULT: If the account exists, a confirmation email has been sent to the associated email address

SUBJ: Reset your password

http://ssp.example.com/?action=resetbytoken&token=3vUCAAkWZC9OyfkK8KEpX1EeY5bUBnGupaPmfRf8NB%2FvkZfP5ZmJaXe7YmpnqBCUvNBI%2BYRTir%2FcA1UYQIZXSL8U4ZfleNVl611WqpGjc5wsRv7e72v6RgZGaqkGvVNFF7Z2SmiMtu0qBxeveQ3Pm6F80ZX8z0%2F6vvJNUFk69joKw6x7G7wT5hLbHtQtu4rVuwPlCg%3D%3D

RESULT: Your password was changed

SET RESULT: Your answer has been registered

objectClass: inetOrgPerson
objectClass: extensibleObject
info: 3vUCACQAzkDYd9EtvhkWagaFWLMkQ/mpTC2xpJuQ3J6zBve+L2siiUWGfnyPxDYob7EoDUgP

<?php
# LDAP directory
$ldap_url = "ldap://openldap:389";
$ldap_starttls = false;
$ldap_binddn = "cn=admin,dc=example,dc=org";
$ldap_bindpw = "q1w2e3r4";
$ldap_base = "dc=example,dc=org";
$ldap_login_attribute = "uid";
$ldap_fullname_attribute = "cn";
$ldap_filter = "(&(objectClass=inetOrgPerson)(uid={login}))";

# Password handling
$ad_mode = false;
$hash = "SSHA";
$ldap_use_exop_passwd = true;
$pwd_show_policy = "always";
$pwd_show_policy_pos = "above";

# Password policy (lab)
$pwd_min_length = 8;
$pwd_max_length = 64;
$pwd_min_lower = 1;
$pwd_min_upper = 1;
$pwd_min_digit = 1;
$pwd_min_special = 1;
$pwd_special_chars = "^a-zA-Z0-9";
$pwd_no_reuse = true;
$pwd_diff_login = true;
$pwd_complexity = 0;

# Features
$use_questions = true;
$use_tokens = true;
$use_sms = false;
$use_captcha = false;

# Mail
$mail_from = "ssp@example.org";
$mail_from_name = "Self Service Password";
$mail_address_use_ldap = true;
$notify_on_change = true;
$mail_smtp_host = 'mailsink';
$mail_smtp_port = 1025;
$mail_smtp_auth = false;
$mail_smtp_secure = '';
$mail_smtp_autotls = false;

# Tokens
$token_lifetime = "3600";
# 1.8.2 强制要求自定义 keyphrase（出厂值 secret 会拒绝服务）
$keyphrase = "88eb2fee3d7b4d1dbbe99573a8be9972";

docker compose restart ssp

docker network create --subnet 10.89.76.0/24 self-service-password-182-net

docker run -d --name self-service-password-182-openldap \
  --hostname openldap --network self-service-password-182-net \
  -e LDAP_ORGANISATION="Example Org" -e LDAP_DOMAIN="example.org" \
  -e LDAP_BASE_DN="dc=example,dc=org" -e LDAP_ADMIN_PASSWORD="q1w2e3r4" \
  -e LDAP_CONFIG_PASSWORD="q1w2e3r4" \
  -v /opt/self-service-password-1.8.2/openldap/ldif:/container/service/slapd/assets/config/bootstrap/ldif/custom:ro \
  osixia/openldap:latest --copy-service

docker run -d --name self-service-password-182-mailsink \
  --hostname mailsink --network self-service-password-182-net \
  -e MP_SMTP_AUTH_ACCEPT_ANY=1 -e MP_SMTP_AUTH_ALLOW_INSECURE=1 \
  axllent/mailpit:v1.31.6

docker run -d --name self-service-password-182-web \
  --network self-service-password-182-net -p 8138:80 \
  -v /opt/self-service-password-1.8.2/ssp/config.inc.local.php:/var/www/conf/config.inc.local.php:ro \
  ltbproject/self-service-password:1.8.2

# 栈状态
docker compose ps
# 跟踪 SSP 日志（含邮件发送、LDAP 错误的 php:notice 行）
docker compose logs -f ssp
# 重启 SSP（改配置后）
docker compose restart ssp
# 目录数据检查
ldapsearch -x -H ldap://localhost -b dc=example,dc=org -D cn=admin,dc=example,dc=org -w q1w2e3r4 '(uid=*)' uid
# ACL 检查（cn=config）
ldapsearch -x -H ldap://localhost -b cn=config -D cn=admin,cn=config -w q1w2e3r4 '(olcDatabase={1}mdb)' olcAccess
# mailpit 收件箱（API）
docker exec self-service-password-182-mailsink wget -qO- 'http://localhost:8025/api/v1/messages?limit=5'
# 镜像版本核对
docker exec self-service-password-182-web grep -m1 'version' /var/www/htdocs/index.php
# 停止与清理
docker compose down
docker compose down -v   # 连同数据卷