0

I have an OpenLDAP server and many clients which bind to the server with username/password in order to authenticate against user's passwords. I'd like to change the server's password on a fairly regular basis, but it seems to me that entails a load of manual work going to each client and reconfiguring the bind password on each. Is there an easier/faster/more efficient way that anyone has used in order to update 80+ clients? Thanks.

1 Answer 1

1

In most cases, you don't need to have a bind password on the client at all. Instead, the system tries to bind with the username and password the user supplied and if that suceeds, will log you in.

On my systems, I use a bind password only for administration tasks on the LDAP server.

Other than that: If you have 80 clients, you really should already have some kind of configuration management like Puppet, Chef or Ansible.

2
  • Ah okay, this makes more sense. The way I understood it was that in order to authenticate a user using their password, you had to bind as an admin, just as you have to do while using ldapsearch: no bind, no password hash is returned. Instead, you are sending the username and password together, and LDAP simply says if this combination is correct or not. Does that sum it up correctly?
    – AaplMike
    Jun 23, 2016 at 17:30
  • 1
    Yes, for most cases this is correct.
    – Sven
    Jun 23, 2016 at 17:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .