feat(passwd): accept a username, resolve before prompting

The passwd subcommand used its argument verbatim as the LDAP search base, so
a bare username like 'andy' failed with result code 34 (invalidDNSyntax). It
only ever accepted a full DN.

Now a bare argument (no '=') is resolved to a DN by searching every configured
profile's search_base for (<rdn_attr>=<username>). Resolution runs before the
password prompt, so an unknown or ambiguous username fails immediately instead
of after two password entries; the resolved DN is printed for confirmation. A
full DN still works as before, now with an up-front existence check.

New src/passwd.rs holds the pure resolution logic (looks_like_dn,
username_searches, resolve_outcome) with unit tests; tests/live_passwd.rs
covers resolution against the seeded OpenLDAP server.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: oetiker

CHANGES.md

@@ -8,6 +8,12 @@ All notable changes to eDAPtor are documented here. The format follows
 
 ### New
 
+- **`edaptor passwd` accepts a bare username**, not just a full DN. A username
+  (any argument without an `=`) is resolved to a DN by searching every configured
+  profile's `search_base` for `(<rdn_attr>=<username>)`. The lookup runs **before**
+  the password prompt, so an unknown or ambiguous username fails immediately
+  (with the matching DNs listed on ambiguity) instead of after typing the
+  password twice. The resolved DN is printed before the prompt for confirmation.
 - `examples/oposs-openldap.toml` — ready-to-use config template for directories
   managed by the [oposs.openldap](https://github.com/oposs/oposs.openldap)
   Ansible role (POSIX users, groupOfNames + posixGroup, Samba and mailAccount

docs/src/usage/passwords.md

@@ -32,26 +32,39 @@ Samba credentials in sync in the same atomic change:
 The result is a single password change that updates both the Unix
 (`userPassword`) and Samba (`sambaNTPassword`) credentials together.
 
-## The `edaptor passwd <dn>` CLI
+## The `edaptor passwd <user>` CLI
 
-To set a password without entering the TUI, use the `passwd` subcommand:
+To set a password without entering the TUI, use the `passwd` subcommand. It
+accepts either a **bare username** or a **full DN**:
 
 ```bash
-edaptor passwd uid=alice,ou=people,dc=example,dc=org
+edaptor passwd alice                                   # resolved via the configured profiles
+edaptor passwd uid=alice,ou=people,dc=example,dc=org   # explicit DN
 ```
 
-It prompts for the new password twice (no echo), and on a match performs a
-single atomic MODIFY that updates `userPassword` and — when the target is a
+A bare username (anything without an `=`) is resolved to a DN by searching every
+configured profile's `search_base` for `(<rdn_attr>=<username>)` — e.g.
+`(uid=alice)` under `ou=people`. The lookup happens **before** the password
+prompt, so an unknown or ambiguous username fails immediately instead of after
+you type the password:
+
+- **no match** → `no entry found for username "alice" …`;
+- **more than one match** (e.g. the same name under two profiles) → the matching
+  DNs are listed and you are asked to pass a full DN instead.
+
+Once the target is resolved, edaptor prints which DN it is about to change, then
+prompts for the new password twice (no echo). On a match it performs a single
+atomic MODIFY that updates `userPassword` and — when the target is a
 `sambaSamAccount` — `sambaNTPassword` and `sambaPwdLastSet`. This command is
 **TLS-only** (it refuses to send a cleartext password over an unencrypted
-connection), so the configured server must be reachable over `ldaps://` or with
-StartTLS.
+connection), so the configured server must be reachable over `ldaps://`, with
+StartTLS, or over `ldapi://`.
 
 ## Known gap: no standalone in-TUI "Set Password"
 
 There is currently **no standalone "Set Password" action inside the TUI** for an
 arbitrary entry. Passwords can be set in the TUI only through the **set-password popup**
 on the create/edit form of entries whose profile declares a password widget.
 For any other entry — or to (re)set a password outside that form — use the
-**`edaptor passwd <dn>`** CLI described above.
+**`edaptor passwd <user>`** CLI described above.
 

src/lib.rs

@@ -5,6 +5,7 @@ pub mod app;
 pub mod config;
 pub mod form;
 pub mod ldap;
+pub mod passwd;
 pub mod samba;
 pub mod schema;
 pub mod testdata;
@@ -149,11 +150,85 @@ fn is_samba_account(object_classes: &[String]) -> bool {
 ///
 /// Factored out of `main` (no `rpassword`, no terminal) so the live test can drive
 /// it with a known password.
+/// Search `base` (subtree/base scope per `scope`) for `filter`, returning the
+/// matching entries with their `objectClass` values. The shared LDAP round-trip
+/// behind both passwd-target resolution branches.
+fn search_object_classes(
+    worker: &WorkerHandle,
+    base: &str,
+    scope: SearchScope,
+    filter: &str,
+) -> Result<Vec<crate::ldap::worker::LdapEntry>> {
+    match worker.request(Request::Search {
+        id: 1,
+        base: base.to_string(),
+        scope,
+        filter: filter.to_string(),
+        attrs: vec!["objectClass".to_string()],
+        size_limit: None,
+    })? {
+        Response::Entries { entries, .. } => Ok(entries),
+        Response::SearchError { msg, .. } => Err(anyhow!("searching {base}: {msg}")),
+        other => Err(anyhow!(
+            "unexpected response searching {base}: {}",
+            describe_response(&other)
+        )),
+    }
+}
+
+/// Resolve the `passwd` argument to a concrete `(dn, objectClass values)`. A DN
+/// argument is base-read to confirm it exists; a bare username is searched across
+/// every configured profile's `search_base`, requiring a single match.
+fn resolve_passwd_target(
+    worker: &WorkerHandle,
+    profiles: &[crate::config::EntryProfile],
+    arg: &str,
+) -> Result<(String, Vec<String>)> {
+    if passwd::looks_like_dn(arg) {
+        let entry = search_object_classes(worker, arg, SearchScope::Base, "(objectClass=*)")?
+            .into_iter()
+            .next()
+            .ok_or_else(|| anyhow!("entry not found: {arg}"))?;
+        let ocs = entry.attrs.get("objectClass").cloned().unwrap_or_default();
+        return Ok((entry.dn, ocs));
+    }
+
+    // Bare username: gather candidates across every profile's search base.
+    let mut matched: Vec<crate::ldap::worker::LdapEntry> = Vec::new();
+    for (base, filter) in passwd::username_searches(profiles, arg) {
+        matched.extend(search_object_classes(
+            worker,
+            &base,
+            SearchScope::Subtree,
+            &filter,
+        )?);
+    }
+    let dns = matched.iter().map(|e| e.dn.clone()).collect();
+    match passwd::resolve_outcome(dns) {
+        passwd::Resolution::Unique(dn) => {
+            let ocs = matched
+                .into_iter()
+                .find(|e| e.dn.eq_ignore_ascii_case(&dn))
+                .and_then(|e| e.attrs.get("objectClass").cloned())
+                .unwrap_or_default();
+            Ok((dn, ocs))
+        }
+        passwd::Resolution::NotFound => Err(anyhow!(
+            "no entry found for username \"{arg}\" in any configured profile; \
+             pass a full DN instead"
+        )),
+        passwd::Resolution::Ambiguous(dns) => Err(anyhow!(
+            "username \"{arg}\" matches multiple entries:\n  {}\npass a full DN instead",
+            dns.join("\n  ")
+        )),
+    }
+}
+
 pub fn run_passwd(
     config: Config,
     bind_password: String,
-    target_dn: &str,
-    new_password: &str,
+    target_arg: &str,
+    prompt: impl FnOnce(&str) -> Result<String>,
 ) -> Result<String> {
     // TLS gate FIRST — before spawning the worker or touching the network.
     if !samba::password::is_secure(&config.server) {
@@ -163,42 +238,28 @@ pub fn run_passwd(
         ));
     }
 
+    // Profiles are needed for username resolution after `config` moves into the
+    // worker, so capture them first.
+    let profiles = config.profiles.clone();
     let worker = WorkerHandle::spawn(config, bind_password)?;
 
-    // Read the target's objectClass values to detect a sambaSamAccount.
-    let object_classes = match worker.request(Request::Search {
-        id: 1,
-        base: target_dn.to_string(),
-        scope: SearchScope::Base,
-        filter: "(objectClass=*)".to_string(),
-        attrs: vec!["objectClass".to_string()],
-        size_limit: None,
-    })? {
-        Response::Entries { entries, .. } => entries
-            .into_iter()
-            .next()
-            .ok_or_else(|| anyhow!("entry not found: {target_dn}"))?
-            .attrs
-            .get("objectClass")
-            .cloned()
-            .unwrap_or_default(),
-        Response::SearchError { msg, .. } => return Err(anyhow!(msg)),
-        other => {
-            return Err(anyhow!(
-                "unexpected response reading {target_dn}: {}",
-                describe_response(&other)
-            ))
-        }
-    };
+    // Resolve the target to a concrete DN (and its objectClass values, used for
+    // samba detection) BEFORE prompting for the new password, so an unknown or
+    // ambiguous username fails fast instead of after two password entries.
+    let (target_dn, object_classes) = resolve_passwd_target(&worker, &profiles, target_arg)?;
     let is_samba = is_samba_account(&object_classes);
 
+    // Now that the target is known, prompt for the new password.
+    let new_password = prompt(&target_dn)?;
+    let target_dn = target_dn.as_str();
+
     // Domain discovery is intentionally omitted from the password path:
     // `build_password_mods` derives `sambaNTPassword` from the cleartext alone and
     // never needs the domain SID / RID base (those are only required when
     // *creating* a samba account, not when re-setting its password). Keeping the
     // flow free of best-effort discovery keeps it correct and simple.
 
-    let mods = samba::password::build_password_mods(new_password, is_samba, now_unix_secs()?);
+    let mods = samba::password::build_password_mods(&new_password, is_samba, now_unix_secs()?);
 
     match worker.request(Request::Modify {
         id: 2,

src/main.rs

@@ -36,8 +36,10 @@ enum Command {
     /// new password twice; updates `userPassword` and, for a `sambaSamAccount`,
     /// `sambaNTPassword` + `sambaPwdLastSet` in one atomic MODIFY.
     Passwd {
-        /// Target entry DN, e.g. uid=alice,ou=people,dc=example,dc=org
-        dn: String,
+        /// Target username or full DN, e.g. `alice` or
+        /// `uid=alice,ou=people,dc=example,dc=org`. A bare username is resolved
+        /// against the configured profiles' search bases.
+        user: String,
     },
 }
 
@@ -88,9 +90,11 @@ fn main() -> Result<()> {
             let report: SchemaReport = edaptor::run_schema(config, password, &object_class)?;
             print_schema(&report);
         }
-        Some(Command::Passwd { dn }) => {
-            let new_password = prompt_new_password()?;
-            let confirmation = edaptor::run_passwd(config, password, &dn, &new_password)?;
+        Some(Command::Passwd { user }) => {
+            let confirmation = edaptor::run_passwd(config, password, &user, |dn| {
+                println!("Setting password for {dn}");
+                prompt_new_password()
+            })?;
             println!("{confirmation}");
         }
     }