Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a Linux server farm along with some Windows machines, and I finally moved us from two parallel authentication systems (using Fedora Directory Services and Active Directory) to one -- just Active Directory. I configured LDAPS, and everything works except one thing.

I checked before deployment that I could change my password, and I still can. But I'm an admin. (Actually, I'm an engineer playing an admin on TV, but that's a story for another time.)

None of my users can change their passwords (using passwd on the Linux command line). They get the error

LDAP password information update failed: Can't contact LDAP server 00002098: SecErr: DSID-03150A45, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

Running around Google doesn't give any obvious answers, but clearly there's some issue with users having rights to change their passwords via LDAPS when admins can do it. (I've checked that users have the right to change their password, of course.)

Any ideas?

share|improve this question

Sigh. Fixed it. This link had the necessary fix buried deep in it: the standard pam_password md5 in ldap.conf needs to be changed to pam_password ad.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.