I'm using centos 6.7 to create LDAP server, but the user still cannot change their own password.

The error when user try to change the password :

[john2@servergw ~]$ passwd
Changing password for user john2.
Enter login(LDAP) password: 
New password: 
Retype new password: 
LDAP password information update failed: Insufficient access
Retype new password:

here is my /etc/openldap/slapd.conf on server-side :

access to attrs=userPassword,shadowLastChange
  by self write
  by anonymous auth
  by * none
access to *
  by self write
  by * read

My /etc/pam.d/passwd on client-side :

password required pam_cracklib.so retry=3
password sufficient pam_ldap.so use_authtok
password sufficient pam_unix.so nullok use_authtok md5 shadow
password required pam_deny.so
auth       include      system-auth
account    include      system-auth
password   substack     system-auth

Please help


try using this ACL in your olcDatabase={2}bdb.ldif file

olcAccess: {0}to attrs=userPassword by self write by dn.base="cn=admin,dc=domain,dc=com" write by anonymous auth by * none

Using the dn.base allow him to write the password. Some suggest to create a user that his sole role is to do such a thing, but i found using the dn.base usually works well

  • Doesn't this allow anyone to change anyone else's password? – symcbean Jul 16 '19 at 8:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.