0

I'm trying to set up our LDAP server so that members of the pwmadmins group can change people's passwords for them. To be more specific, we have PWM for Tomcat set up and are trying to let pwmadmins change people's passwords through that. But for some reason people in the pwmadmins group still don't have permission to change people's passwords.

Here is what the ALC section of the olcDatabase={1}hdb.ldif file looks like now (I've displayed all of it, even though I'm only concerned with section {0}):

olcAccess: {0}to attrs=userPassword,shadowLastChange
 by dn="cn=pwmadmin,dc=cs,dc=school,dc=edu" write
 by group.exact="cn=pwmadmins,ou=groups,dc=cs,dc=school,dc=edu" write
 by anonymous auth
 by self write
 by * none
olcAccess: {1}to attrs=loginShell,gecos
 by dn="cn=admin,dc=cs,dc=school,dc=edu" write
 by self write
 by * read
olcAccess: {2}to attrs=loginShell,gecos
 by dn="cn=pwmadmin,dc=cs,dc=school,dc=edu" write
olcAccess: {3}to dn.base=""
 by * read
olcAccess: {4}to *
 by dn="cn=admin,dc=cs,dc=school,dc=edu" write
 by * read

(New lines added for clarity.) I've checked the format with a few other similar questions on this site to make sure that I have the order, spacing, etc down right, but it's still not working. I have the memberOf filter installed, and I've confirmed that that's working correctly on PWM. And when I gave my UID the ability to change passwords, it worked correctly. So it's clearly something with the group syntax, but I'm not sure what. Any help is much appreciated!

EDIT: Found a solution - see below.

1 Answer 1

0

I was able to get it working by making pwmadmins into a groupOfNames instead of a posixGroup, and then by implementing the following code:

olcAccess: {0}to attrs=userPassword,shadowLastChange
 by dn="cn=pwmadmin,dc=cs,dc=school,dc=edu" write
 by set="[cn=pwmadmins,ou=groups,dc=cs,dc=school,dc=edu]/member & user" write
 by anonymous auth
 by self write
 by * none
olcAccess: {1}to attrs=loginShell,gecos
 by dn="cn=admin,dc=cs,dc=school,dc=edu" write
 by self write
 by * read
olcAccess: {2}to attrs=loginShell,gecos
 by dn="cn=pwmadmin,dc=cs,dc=school,dc=edu" write
olcAccess: {3}to dn.base=""
 by * read
olcAccess: {4}to *
 by dn="cn=admin,dc=cs,dc=school,dc=edu" write
 by * read

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .