up vote 0 down vote favorite
share [g+] share [fb]

How to allow LDAP users to change password from client machines ?

link|improve this question
72% accept rate
feedback

2 Answers

up vote 2 down vote accepted

You can't. LDAP is a directory service and does not provide end-user tools. It's the responsibility of the end-user tool to provide this functionality.

e.g. it should be possible using 'passwd', assuming that you've got PAM authentication using LDAP configured correctly

link|improve this answer
any gui end user tools available ? – nitins Sep 16 '10 at 12:23
2  
Yes - any pam compliant one. There are other tools which are intended for managing an LDAP system which allow users to change their own passwords (e.g. GoSA) but why go through all that pain just to provide a facility for changing passwords? Its not rocket science to write your own (e.g. logout.sh/computers/ldap) – symcbean Sep 16 '10 at 12:38
feedback
up vote 1 down vote

OpenLDAP's default configuration already has that:

# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only
access to attrs=userPassword,shadowLastChange
        by anonymous auth
        by self write
        by * none
link|improve this answer
1  
is this in slapd.conf ? – nitins Sep 17 '10 at 6:11
Yes. Doesn't work like this when using the cn=conf backend of course. – al. Sep 21 '10 at 11:45
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.