I want to allow ldap user to change their password but how?
passwd? or ldappasswd? It won't work for me this time.
What will be the configurations for this in order the user will successfully change their passwords?

Any help will do. Thanks.


in the slapd.conf write access control rule

access to attrs=userPassword   
by self =xw

But you should be aware that specific rules are to be written first and general rule at the end.
for example following rule has to be written at the end.

access to * by * read 

for more information visit: http://www.openldap.org/doc/admin24/access-control.html

slapd.conf is generally located in

/etc/openldap or  
/etc/ldap/ or 
/usr/local/etc/openldap/ or  

There are some changes in newer versions of ldap where slapd.conf is supported but by default the data is stored in slapd.d directory. if you put your custom slapd.conf there, the process will read slapd.conf instead of slapd.d directory

Things to notice

  1. sometimes slapd.conf is present in both local as well as global path try changing both
  2. delete slapd.d direcotry as it is default to make slapd.conf work
  • Thanks. @Gaurav But what slapd.conf file will I edit? Is it /usr/share/slapd/slapd.conf or /usr/share/slapd/examples/slapd.conf? – ckknight Sep 2 '13 at 8:24
  • its normally in /etc/openldap or /etc/ldap/ – Gaurav Sep 2 '13 at 10:25
  • it is not working for me (ubuntu 12,04) – Chenming Zhang Jun 26 '14 at 6:57
  • i found this in /usr/share/slapd/slapd.conf. by changing this, problem is still there.. – Chenming Zhang Jun 26 '14 at 7:32
  • (My answer is valid for openldap)1. sometimes slapd.conf is present in both local as well as global path try changing both 2. delete slapd.d direcotry as it is default to make slapd.conf work – Gaurav Jun 26 '14 at 17:34

I found the solution on http://ubuntuforums.org/showthread.php?t=1640070

At /etc/pam.d/common-password

# /etc/pam.d/common-password - password-related modules common to all services
# -- removed comment header talking about various options --

# here are the per-package modules (the "Primary" block)
password    [success=2 default=ignore]  pam_unix.so obscure sha512
password    [success=1 user_unknown=ignore default=die] pam_ldap.so use_authtok try_first_pass
# here's the fallback if no module succeeds
password    requisite           pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password    required            pam_permit.so
# and here are more per-package modules (the "Additional" block)
password    optional    pam_gnome_keyring.so 
# end of pam-auth-update config

Try removing the use_authtok parameter and save the file. You may need to restart.

It works! Tee hee

  • Yes, but somehow all the local machine has to be confiugred. also it is not sure what is the consequence of doing this in the local machine – Chenming Zhang Jun 26 '14 at 7:31
  • @ChenmingZhang The consequence is that it allows LDAP user/client to change password. – ckknight Aug 11 '14 at 2:41
  • so you suggestion is that we need to inform every user in LDAP realm that once you want to change the password, change the common-password accordingly (not quite intruitive). – Chenming Zhang Aug 12 '14 at 2:47
  • You may create an Ubuntu client ISO which the common-password file is changed. So when it installed, the client user doesn't need to change the common-password file. Or as an admin you may change the common password file. – ckknight Aug 15 '14 at 5:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.