Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How to allow LDAP users to change password from client machines ?

share|improve this question
up vote 2 down vote accepted

You can't. LDAP is a directory service and does not provide end-user tools. It's the responsibility of the end-user tool to provide this functionality.

e.g. it should be possible using 'passwd', assuming that you've got PAM authentication using LDAP configured correctly

share|improve this answer
any gui end user tools available ? – nitins Sep 16 '10 at 12:23
Yes - any pam compliant one. There are other tools which are intended for managing an LDAP system which allow users to change their own passwords (e.g. GoSA) but why go through all that pain just to provide a facility for changing passwords? Its not rocket science to write your own (e.g. – symcbean Sep 16 '10 at 12:38

OpenLDAP's default configuration already has that:

# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only
access to attrs=userPassword,shadowLastChange
        by anonymous auth
        by self write
        by * none
share|improve this answer
is this in slapd.conf ? – nitins Sep 17 '10 at 6:11
Yes. Doesn't work like this when using the cn=conf backend of course. – al. Sep 21 '10 at 11:45
Any idea how we could do this on 389 directory server? – chandank Nov 16 '12 at 19:56

For users of 389 using bind accounts, you can create an ACL as per the following for bind accounts:

(targetattr ="*")(version 3.0;acl "Bind Accounts";allow (all) (groupdn = "ldap:///cn=Bind Accounts, dc=ldap,dc=server");)

share|improve this answer

You can enable the ldap-auth-client (debian and ubuntu) to edit passwords like you would on a local machine. if you run dpkg-reconfigure ldap-auth-config and select yes for Make local root Database admin this will allow you to run passwd like you normally would.

You can also do this by editing your /etc/ldap.conf file and adding:

# The distinguished name to bind to the server with
# if the effective user ID is root. Password is
# stored in /etc/ldap.secret (mode 600)
rootbinddn dn-for-your-admin-account-in-ldap

If you edit the file manually, you need to post the password for the root account in /etc/ldap.secret and make it 600

You may also have to edit /etc/pam.d/common-password and remove the use_authtok parameter. If you edit your pam files be sure to run pam-auth-update or reboot the system.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.