OpenLDAP: Allow users to change their password with the unix passwd command.
If you run into this ldap error below, this is the correct way to fix it.
[litogo@sge4 ~]$ passwd Changing password for user litogo. (current) LDAP Password: New password: Retype new password: password change failed: Insufficient access passwd: Authentication token manipulation error
The issue here is that ldap server is not allowing the user password to be changed without the ldap manager's credential.
You need to add an ACL to allow this password change by the user.
If you google for this error, you will encounter people telling you to append an acl to the file
/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif
Stop, if you look at this file it has this warning.
[root@oel75 cn=config]# head -1 /etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
The correct way is to create a ldif file and run it with the ldapmodify command.
Change dn.base with the correct ldap manager account for your domain.
[root@oel75 slapd.d]# cat passwordaccess.ldif dn: olcDatabase={2}hdb,cn=config changetype: modify add: olcAccess olcAccess: to attrs=userPassword by self write by anonymous auth by dn.base="cn=ldapadm,dc=unixguide,dc=net" write by * none add: olcAccess olcAccess: to * by self write by dn.base="cn=ldapadm,dc=unixguide,dc=net" write by * read [root@oel75 slapd.d]# ldapmodify -Y EXTERNAL -H ldapi:/// -f passwordaccess.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={2}hdb,cn=config"
Now, you can see the acl written in the /etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif file.
[root@oel75 cn=config]# cat /etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 6630f395 dn: olcDatabase={2}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap olcDbIndex: objectClass eq,pres olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub structuralObjectClass: olcHdbConfig entryUUID: 953b2c30-39de-1038-951d-9b54516c7738 creatorsName: cn=config createTimestamp: 20180821223751Z olcSuffix: dc=unixguide,dc=net olcRootDN: cn=ldapadm,dc=unixguide,dc=net olcRootPW:: e1NTSEF9MWVxeTI2L28rUXB6NjYvZXJtUXJsSkRFUlZaY1ptZnE= olcAccess: {0}to attrs=userPassword by self write by anonymous auth by dn.ba se="cn=ldapadm,dc=unixguide,dc=net" write by * none olcAccess: {1}to * by self write by dn.base="cn=ldapadm,dc=unixguide,dc=net" write by * read entryCSN: 20180919183231.960500Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20180919183231Z
Recent comments