Python ldap3库中LDAP属性修改的正确姿势：解决“只读”错误

# ... 之前的代码，获取到 entry 对象 ...
entry.sn = new_last_name # 尝试直接修改 entry 对象的属性
# ... 之后可能尝试调用 modify ...

modifications = {
    'attribute_name_1': [(operation_type_1, [value_1a, value_1b, ...])],
    'attribute_name_2': [(operation_type_2, [value_2a, ...])],
    # ... 更多属性
}

from ldap3 import Server, Connection, SUBTREE, MODIFY_REPLACE
from ldap3.core.exceptions import LDAPOperationResult

def is_valid_serial_number(pesel_number):
    """
    一个简单的PESEL号码验证函数（仅作示例，实际验证可能更复杂）
    """
    return len(pesel_number) == 11 and pesel_number.isdigit()

def modify_user_lastname(server_address, bind_dn, bind_password):
    """
    连接LDAP服务器并修改指定用户的姓氏。
    """
    server = Server(server_address, port=389, use_ssl=False) # 根据实际情况调整端口和SSL
    conn = Connection(server, user=bind_dn, password=bind_password, auto_bind=True)

    if not conn.bind():
        print(f"LDAP连接失败: {conn.result}")
        return

    try:
        while True:
            pesel = input("请输入用户PESEL号码以修改其姓氏: ")
            if not is_valid_serial_number(pesel):
                print("无效的PESEL号码，请重新输入。")
                continue
            break

        # 搜索用户
        search_base = 'dc=test,dc=local' # 根据您的LDAP结构调整
        search_filter = f'(serialNumber={pesel})'
        conn.search(search_base=search_base, search_filter=search_filter, 
                    search_scope=SUBTREE, 
                    attributes=['sAMAccountName', 'givenName', 'sn', 'serialNumber', 'cn'])

        if not conn.entries:
            print(f"未找到PESEL为 {pesel} 的用户。")
            return

        entry = conn.entries[0]
        dn = entry.entry_dn
        print(f"找到用户DN: {dn}")
        print(f"当前属性: {entry.entry_attributes_as_dict}")

        old_last_name = entry['sn'].value if 'sn' in entry else "无"
        new_last_name = input("请输入新的姓氏: ")

        print(f"确认是否将用户 {entry.sAMAccountName.value} 的姓氏从 '{old_last_name}' 更改为 '{new_last_name}'。")
        confirmation = input("1. 确认\n2. 取消\n请选择操作: ")

        if confirmation == '1':
            # 构建修改字典
            modifications = {
                'sn': [(MODIFY_REPLACE, [new_last_name])]
            }

            # 执行修改操作
            if conn.modify(dn, modifications):
                print(f"用户 {entry.sAMAccountName.value} 的姓氏已成功更改为 '{new_last_name}'。")
            else:
                print(f"修改姓氏失败: {conn.result}")
                # 打印详细错误信息，帮助调试
                if conn.result and 'description' in conn.result:
                    print(f"错误详情: {conn.result['description']}")
        else:
            print("操作已取消。")

    except LDAPOperationResult as e:
        print(f"LDAP操作错误: {e}")
        print(f"详细错误: {conn.result}")
    except Exception as e:
        print(f"发生未知错误: {e}")
    finally:
        conn.unbind()
        print("LDAP连接已关闭。")

# 示例调用
if __name__ == "__main__":
    # 请替换为您的LDAP服务器地址、绑定DN和密码
    ldap_server = 'your_ldap_server.com' 
    ldap_bind_dn = 'cn=admin,dc=test,dc=local' # 具有修改权限的DN
    ldap_bind_password = 'your_password'

    modify_user_lastname(ldap_server, ldap_bind_dn, ldap_bind_password)