RE: Allow users to change ldap password with passwd

To: "Real, Elizabeth (392K)" <Elizabeth.Real@jpl.nasa.gov>, Michael Ströder <michael@stroeder.com>, "openldap-technical@openldap.org" <openldap-technical@openldap.org>

Subject: RE: Allow users to change ldap password with passwd

From: Craig White <CWhite@skytouchtechnology.com>

Date: Mon, 5 Oct 2015 22:52:32 +0000

Accept-language: en-US

Authentication-results: spf=none (sender IP is ) smtp.mailfrom=CWhite@skytouchtechnology.com;

Content-language: en-US

In-reply-to: <D238490C.10F79%Elizabeth.Real@jpl.nasa.gov>

References: <D22182AC.F547%Elizabeth.Real@jpl.nasa.gov> <55FC3B5E.9010701@stroeder.com> <D229806C.FDC6%Elizabeth.Real@jpl.nasa.gov> <56043966.60100@stroeder.com> <D22989C8.FDF9%Elizabeth.Real@jpl.nasa.gov> <56043D04.6060808@stroeder.com> <D2298BCD.FE00%Elizabeth.Real@jpl.nasa.gov> <56044431.7090101@stroeder.com> <D22F0E94.102EC%Elizabeth.Real@jpl.nasa.gov> <560A2865.1050504@stroeder.com> <D23810AF.10E72%Elizabeth.Real@jpl.nasa.gov> <BY2PR08MB180061E6A98D84AC8BA9947CB3480@BY2PR08MB1800.namprd08.prod.outlook.com> <D238490C.10F79%Elizabeth.Real@jpl.nasa.gov>

Spamdiagnosticmetadata: NSPM

Spamdiagnosticoutput: 1:23

Thread-index: AQHQ8irY1XqsagEwKECIHh9Q/CK1gp5CeWYAgAmEjgCAAAKBAIAAAxmAgAABNwCAAAIXgIAABneAgAaNkoCAAHhZgIAKXkEAgAAXFECAABDZAIAAArAg

Thread-topic: Allow users to change ldap password with passwd

From: Real, Elizabeth (392K) [mailto:Elizabeth.Real@jpl.nasa.gov]
Sent: Monday, October 05, 2015 3:41 PM
To: Craig White; Michael Ströder; openldap-technical@openldap.org
Subject: Re: Allow users to change ldap password with passwd

Thanks for the tip. I added the pwdPolicySubentry to one user but it did not work, the attribute is not listed for the user.

I read that this attribute has to be enabled in the ppolicy schema?? I looked at my ppolicy schema which is located here: /etc/openldap/slapd.d/cn=config/cn=schema/cn={3}ppolicy.ldif HOWEVER I did not find pwdPolicySubentry.

What version of openldap is your suggestion based of? I’m running v2.4.39.

You really need to increase your level of LDAP fu.

pwdPolicySubEntry is an operational attribute which won’t normally show up.

Google is your friend.

Craig