OpenLDAP: Allow users to change their password with the unix passwd command.
If you run into this ldap error below, this is the correct way to fix it.
[litogo@sge4 ~]$ passwd Changing password for user litogo. (current) LDAP Password: New password: Retype new password: password change failed: Insufficient access passwd: Authentication token manipulation error
The issue here is that ldap server is not allowing the user password to be changed without the ldap manager's credential.
You need to add an ACL to allow this password change by the user.
If you google for this error, you will encounter people telling you to append an acl to the file
/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif
Stop, if you look at this file it has this warning.
[root@oel75 cn=config]# head -1 /etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
The correct way is to create a ldif file and run it with the ldapmodify command.
Change dn.base with the correct ldap manager account for your domain.
[root@oel75 slapd.d]# cat passwordaccess.ldif
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: to attrs=userPassword by self write by anonymous auth by dn.base="cn=ldapadm,dc=unixguide,dc=net" write by * none
add: olcAccess
olcAccess: to * by self write by dn.base="cn=ldapadm,dc=unixguide,dc=net" write by * read
[root@oel75 slapd.d]# ldapmodify -Y EXTERNAL -H ldapi:/// -f passwordaccess.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={2}hdb,cn=config"
Now, you can see the acl written in the /etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif file.
[root@oel75 cn=config]# cat /etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 6630f395
dn: olcDatabase={2}hdb
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {2}hdb
olcDbDirectory: /var/lib/ldap
olcDbIndex: objectClass eq,pres
olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
structuralObjectClass: olcHdbConfig
entryUUID: 953b2c30-39de-1038-951d-9b54516c7738
creatorsName: cn=config
createTimestamp: 20180821223751Z
olcSuffix: dc=unixguide,dc=net
olcRootDN: cn=ldapadm,dc=unixguide,dc=net
olcRootPW:: e1NTSEF9MWVxeTI2L28rUXB6NjYvZXJtUXJsSkRFUlZaY1ptZnE=
olcAccess: {0}to attrs=userPassword by self write by anonymous auth by dn.ba
se="cn=ldapadm,dc=unixguide,dc=net" write by * none
olcAccess: {1}to * by self write by dn.base="cn=ldapadm,dc=unixguide,dc=net"
write by * read
entryCSN: 20180919183231.960500Z#000000#000#000000
modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
modifyTimestamp: 20180919183231Z
Recent comments