Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I want to allow ldap user to change their password but how?
passwd? or ldappasswd? It won't work for me this time.
What will be the configurations for this in order the user will successfully change their passwords?

Any help will do. Thanks.

share|improve this question

2 Answers 2

in the slapd.conf write access control rule

access to attrs=userPassword   
by self =xw

But you should be aware that specific rules are to be written first and general rule at the end.
for example following rule has to be written at the end.

access to * by * read 

for more information visit: http://www.openldap.org/doc/admin24/access-control.html

MORE INFO
slapd.conf is generally located in

/etc/openldap or  
/etc/ldap/ or 
/usr/local/etc/openldap/ or  
/usr/local/etc/ldap/  

There are some changes in newer versions of ldap where slapd.conf is supported but by default the data is stored in slapd.d directory. if you put your custom slapd.conf there, the process will read slapd.conf instead of slapd.d directory

Things to notice

  1. sometimes slapd.conf is present in both local as well as global path try changing both
  2. delete slapd.d direcotry as it is default to make slapd.conf work
share|improve this answer
    
Thanks. @Gaurav But what slapd.conf file will I edit? Is it /usr/share/slapd/slapd.conf or /usr/share/slapd/examples/slapd.conf? –  ckknight Sep 2 '13 at 8:24
    
its normally in /etc/openldap or /etc/ldap/ –  Gaurav Sep 2 '13 at 10:25
    
it is not working for me (ubuntu 12,04) –  Chenming Zhang Jun 26 at 6:57
    
i found this in /usr/share/slapd/slapd.conf. by changing this, problem is still there.. –  Chenming Zhang Jun 26 at 7:32
    
(My answer is valid for openldap)1. sometimes slapd.conf is present in both local as well as global path try changing both 2. delete slapd.d direcotry as it is default to make slapd.conf work –  Gaurav Jun 26 at 17:34
up vote 1 down vote accepted

I found the solution on http://ubuntuforums.org/showthread.php?t=1640070

At /etc/pam.d/common-password

#
# /etc/pam.d/common-password - password-related modules common to all services
# -- removed comment header talking about various options --

# here are the per-package modules (the "Primary" block)
password    [success=2 default=ignore]  pam_unix.so obscure sha512
password    [success=1 user_unknown=ignore default=die] pam_ldap.so use_authtok try_first_pass
# here's the fallback if no module succeeds
password    requisite           pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password    required            pam_permit.so
# and here are more per-package modules (the "Additional" block)
password    optional    pam_gnome_keyring.so 
# end of pam-auth-update config

Try removing the use_authtok parameter and save the file. You may need to restart.
-Tim

It works! Tee hee

share|improve this answer
    
Yes, but somehow all the local machine has to be confiugred. also it is not sure what is the consequence of doing this in the local machine –  Chenming Zhang Jun 26 at 7:31
    
@ChenmingZhang The consequence is that it allows LDAP user/client to change password. –  ckknight Aug 11 at 2:41
    
so you suggestion is that we need to inform every user in LDAP realm that once you want to change the password, change the common-password accordingly (not quite intruitive). –  Chenming Zhang Aug 12 at 2:47
    
You may create an Ubuntu client ISO which the common-password file is changed. So when it installed, the client user doesn't need to change the common-password file. Or as an admin you may change the common password file. –  ckknight Aug 15 at 5:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.