problems changing passwords about node-ldapjs

[WanpengQian]

Since your code has an attribute sAMAccountName, assume your LDAP server is Windows AD Server.

AFAIK, For changing AD password, you should use delete operation follow a add operation, instead of replace operation.

replace operation is for password reset, that is the permission of administrator. while normal user has not such permission. for ref: https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/change-windows-active-directory-user-password

another thing, when you change password, you should use LDAPS instead of LDAP. for AD server, you have to enable LDAPS manually, (default configuration is not enabled.)

Connection sample code

const url = "ldaps://xxx.xxx.xxx.xxx:636";
const client = ldap.createClient({
  url: `${url}`,
  tlsOptions: {
    rejectUnauthorized: false
  }
});

PWD change sample code:

client.search("DC=xxx,DC=xxx,DC=xxx", searchOptions, (err, res) => {
  res.on('searchEntry', entry => {
    let dn = entry.pojo.objectName;
    client.modify(dn, [
      new ldap.Change({
        operation: 'delete',
        modification: new ldap.Attribute({
          type: 'unicodePwd',
          values: encodePassword(currentPassword)
        })
      }),
      new ldap.Change({
        operation: 'add',
        modification: new ldap.Attribute({
          type: 'unicodePwd',
          values: encodePassword(newPassword)
        })
      })
    ], function (e) {
      if (e) {
        resp.json({
          result: "failed",
          message: e
        });
        console.log(e);
      }
      else {
        resp.json({
          result: "success"
        });
        console.log('Password changed!');
      }
    });
  });
  res.on('error', e => {
    console.error('error: ' + e.message);
    resp.json({
      result: "failed",
      message: e
    });
  });
});

function encodePassword(password) {
  return new Buffer('"' + password + '"', 'utf16le').toString();
}

[WanpengQian]

And for TLS version, it depends on your Server Version. NodeJS is mark TLS 1.0/1.1 disabled by default. you have to make sure client and server can success have an TLS handshake.
You can capture the TLS packet by wireshark for sure.