Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How to allow LDAP users to change password from client machines ?

share|improve this question

3 Answers 3

up vote 2 down vote accepted

You can't. LDAP is a directory service and does not provide end-user tools. It's the responsibility of the end-user tool to provide this functionality.

e.g. it should be possible using 'passwd', assuming that you've got PAM authentication using LDAP configured correctly

share|improve this answer
any gui end user tools available ? –  nitins Sep 16 '10 at 12:23
Yes - any pam compliant one. There are other tools which are intended for managing an LDAP system which allow users to change their own passwords (e.g. GoSA) but why go through all that pain just to provide a facility for changing passwords? Its not rocket science to write your own (e.g. logout.sh/computers/ldap) –  symcbean Sep 16 '10 at 12:38

OpenLDAP's default configuration already has that:

# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only
access to attrs=userPassword,shadowLastChange
        by anonymous auth
        by self write
        by * none
share|improve this answer
is this in slapd.conf ? –  nitins Sep 17 '10 at 6:11
Yes. Doesn't work like this when using the cn=conf backend of course. –  al. Sep 21 '10 at 11:45
Any idea how we could do this on 389 directory server? –  chandank Nov 16 '12 at 19:56

For users of 389 using bind accounts, you can create an ACL as per the following for bind accounts:

(targetattr ="*")(version 3.0;acl "Bind Accounts";allow (all) (groupdn = "ldap:///cn=Bind Accounts, dc=ldap,dc=server");)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.