Change ldap user password issue

zeusys · 12-08-2013, 04:58 AM

Hi.

I want to allow users to change their own password.I write an ACL in olcDatabase={2}bdb.ldif file :

Code:

olcAccess: {0}to dn.children="uid=.*,ou=SUDOers,dc=tytech,dc=com"
           attrs=userPassword
           by self write
           by * auth
           by dn.base="cn=manager,dc=tytech,dc=com" write
           by * none

Also I've created a test user called "leo" with password 123456 and try to run the following command to change its password:

Code:

[leo@c62clnt ~]$ ldappasswd -x -W -S -D 'uid=leo,ou=SUDOers,dc=tytech,dc=com'
New password:
Re-enter new password:
Enter LDAP Password:   ####I entered 123456 which required also to login using leo user
ldap_bind: Invalid credentials (49)

I don't know how to fix this issue.I think maybe my ACL has a problem and doesn't allow user to change their password,but ldappasswd return Invalid credentials.
Please guide me how to fix this issue
Thank you
----
Distro : CentOS 6.2 x64
openLDAP Server version : 2.4.23

hussam.dh · 12-08-2013, 10:13 AM

I ran through this issue before ane the solution was to use the right ACLs.
Drop the uid=* part from dn.children so it looks like:
dn.children="ou=..."
Then modify "by * auth" to be:
by anonymous auth
You don't need to give the directory manager any rights because by default he has full access.
You must give the users read access over their other attributes.
For changing password just use the regular passwd command.