I found log in ldap.log file
Apr 12 14:20:54 abc slapd[3136]: => access_allowed: auth access
to "uid=bobliu,ou=it,dc=abc,dc=com" "userPassword" requested
Apr 12 14:20:54 abc slapd[3136]: => slap_access_allowed: backend
default auth access granted to "(anonymous)"
Apr 12 14:20:54 abc slapd[3136]: => access_allowed: auth access
granted by read(=rscxd)
Apr 12 14:20:54 abc slapd[3136]: => access_allowed: backend
default write access denied to "uid=bobliu,ou=it,dc=abc,dc=com"
why access granted to anoymous not bobliu.
On 04/12/2015 10:05 PM, feora wrote:
hi, Dan
thanks for u answer.
I still a little confused about it.
I run the following command
/opt/openldap/bin/ldappasswd -x -D
"uid=bobliu,ou=it,dc=abc,dc=com" -W -S
New password:
Re-enter new password:
Enter LDAP Password:
Result: Insufficient access (50)
when I run ldapsearch is ok.
/opt/openldap/bin/ldapsearch -x -D
"uid=bobliu,ou=it,dc=abc,dc=com" -W
# bobliu, it, abc.com
dn: uid=bobliu,ou=it,dc=abc,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: bobliu
sn: fei
givenName: bobliu
cn: bobliu
displayName: bobliu
uidNumber: 10010
gidNumber: 10010
loginShell: /bin/bash
homeDirectory: /home/bobliu
mail: bobliu@abc.com
userPassword::
e3NzaGF9c1RLZW5oL2kxdmlocGw1NG55dUQybHA4ZldSM3o5RzIwdGZwSnc9PQ=
=
any advice. thanks
On 04/02/2015 01:40 AM, Dan White
wrote:
On 03/31/15 17:47 +0800, rockwang wrote:
access to attrs=userPassword
by self write
by anonymous auth
by dn.base="cn=Manager,dc=abc,dc=com"
by * none
access to *
by self write
by dn.base="cn=Manager,dc=abc,dc=com"
by * read
by * none
my question is user can't change his own password. I use
following command
so I have different result.
<img />
when not add -x
<img />
Consult the manpage for ldappasswd. In the first case (simple
bind) you did
not provide a binddn (-D). In the second case, you directed
ldappasswd to
perform a SASL bind but did not correctly provide an
authentication
identity, and the sasl mechanism negotiated could not derive
one.
Hint: if using a simple bind, specify a full DN (with -D), and
not a
uid.
|