Module active_directory 

On-premises Active Directory, rotated by an administrative reset of the account’s unicodePwd over LDAPS.

rotate connects to LDAP_HOST and binds as the delegated service account in BIND_DN. It searches below BASE_DN for the one user whose sAMAccountName or userPrincipalName is the account identity, then replaces that user’s unicodePwd with the new password. A reset doesn’t need the current password and isn’t checked against password history, so a retry can resend the same password. verify opens a new session, finds the account again and binds as it with the new password. Session termination isn’t supported, since a reset can’t revoke Kerberos tickets already issued.

Every connection is LDAPS and trusts the platform roots plus any CA_CERTIFICATE anchors. There is no plaintext, StartTLS or skip-verification path, since a domain controller refuses a unicodePwd write without encryption anyway.

What a failure says about the target depends on its Phase. A failure before the write and a rejected write both leave the target unchanged, while a write that got no answer may have landed. Once a write in an attempt has gone unanswered, a later try that fails before writing reports the effect as unknown, and a permanent rejection is settled by binding as the account with the new password. Operator-facing behaviour is in the crate README.

Modules

classify 🔒

password_write 🔒

session 🔒

tls 🔒

Structs

ActiveDirectoryIntegration 🔒

The Integration for Active Directory targets.

Credentials 🔒

Constants

TIMEOUTS 🔒

ldap3 sets no connect or operation timeout, so without these a domain controller that stops answering would hang the rotation.

Functions

as_applied 🔒

get_cred 🔒

optional_cred 🔒