How to promote ldap user to adminstrator role?

Question

I am doing this project to centralize the auth from openldap, I trap the problem below: now my ldap users asign to the sudo group(command 'id'),so I can do all the implent from the command terminal, but in the user-account box (right top desktop screen),it display standard role for my ldap user, every time ldap user change his password, they should type the administaror's password,but its password unkown to the ldap users.

Can promote ldap user to adminstrator role ? Any script method ? I have 500+ ldap user auth.

Answer 1

you don't need to have any administrative role to change your own password in ldap. . Being able to authenticate with your own credentials is enough.

Jere is a script that you can use to allow a user to change password against your ldap server. It also forces users to use a password length of minimum 8 characters. The correct way would of course to enforce this change on the ldap server with the ppolicy (password policyoverlay) since it can easily be overridden by any user who reads the script or calls ldappasswd from the shell him/her self

#!/bin/bash
# a simple yet precise script to allow users to set their own ldap password

stty -echo
pwdminlenght=8
passwordok=true
username=$(whoami)

printf "Please enter your current ldap password:\n"
read currentpassword


printf "Please enter your new password:\n"
read password

pwdlenght=$(echo ${#password})
if  [ "$pwdminlenght" -gt "$pwdlenght" ] ; then
        printf "Error, new password to short  must be > 8 characters\n"
        passwordok=false
fi  

if [ "$passwordok" = "true" ] ; then
                ldappasswd -x -w $currentpassword -s $password -D uid=$username,ou=int,dc=yourcompany,dc=org -h hostnameofyourldapserver.org
fi
stty echo