2

Original

I am running an openldap-2.4.40 authentication system and would a user to be able to change his password on hisown. With a dynamic configuration (meaning I am not using slapd.conf for configuration but the files in the cn=config directory), I tried changing the password with

ldappasswd -x -D "uid=<my_user>,ou=Users,dc=<some>,dc=<dc>" -W -A -S

This prompts me for my old password (twice) and for the new one and then asks for the LDAP password terminating with the error messag: ldap_bind: Invalid credentials (49).

  1. Why does the command ask me for the LDAP password. The standard user should not know that password
  2. Why does the program terminate with invalid credentials?

In my /etc/openldap/slapd.d/cn=config/olcDatabase={0}config.ldif I have the following settings for olcAccess:

olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none

What do I need to do so that the user is able to change his password?

Edit

Responding to the answer of Simon Schürg I add the contents of /etc/pam.d/passwd:

auth       include      system-auth
account    include      system-auth
password   substack     system-auth
-password   optional    pam_gnome_keyring.so use_authtok
password   substack     postlogin

If I change the password with passwd everything works just fine and I can log myself in with the new password, but only on the machine with the LDAP server running. I cannot login on all other machines ("the LDAP clients").

Edit2

An ldapsearch on a user or group on the server and client machines provides the same output. However, authconfig --test output differs if performed as root or as a user:

Performed as root:

nss_ldap is enabled
 LDAP+TLS is disabled
 LDAP server = "ldap://10.0.0.254"
 LDAP base DN = "dc=example,dc=com"

pam_ldap is enabled
 LDAP+TLS is disabled
 LDAP server = "ldap://10.0.0.254"
 LDAP base DN = "dc=example,dc=com"
 LDAP schema = "rfc2307"

Performed as user:

nss_ldap is enabled
 LDAP+TLS is disabled
 LDAP server = ""
 LDAP base DN = ""

pam_ldap is enabled
 LDAP+TLS is disabled
 LDAP server = ""
 LDAP base DN = ""
 LDAP schema = "rfc2307"

If any information for the answer is missing please let me know and I will edit the question and provide you with the information.

  • Your authconfig --test results show the root user is configured to see LDAP and the regular is not. Is this on the LDAP server or on a client machine? You need your clients to allow local login (so that root access is preserved) and to allow LDAP authenticated login. – Xalorous Oct 5 '16 at 16:46
4
+50

If you enable LDAP authentication globally through PAM and configure /etc/pam.d/passwd, users can change their own LDAP password through the passwd command like it's common for local Unix accounts.

I expect you are already able to log in with ldap users.

In order to allow password changes with the passwd command yout you have to edit /etc/pam.d/passwd and add

password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

------ edit ------

Instead of editing the configuration files manually you could also use authconfig to configure ldap on the centos client. The following command configures LDAP authentication in a way that users can change their password with the common passwd command.

authconfig \
  --enableldap \
  --enableldapauth \
  --ldapserver='ldap://example.com/' \
  --ldapbasedn='dc=example,dc=com' \
  --update

Maybe you want also use the following flags to preserve local authentication and auto creation of non-existing home directories at login.

  --enablemkhomedir \ 
  --enableshadow \
  --enablelocauthorize \
  --passalgo=sha256 \

After the previous command run authconfig --test to verify the settings.
Check the following parts of the output:

nss_ldap is enabled
 LDAP+TLS is disabled
 LDAP server = "ldap://example.com/"
 LDAP base DN = "dc=example,dc=com"

pam_unix is always enabled
 shadow passwords are enabled
 password hashing algorithm is sha256

pam_ldap is enabled
 LDAP+TLS is disabled
 LDAP server = "ldap://example.com/"
 LDAP base DN = "dc=example,dc=com"
 LDAP schema = "rfc2307"

pam_mkhomedir or pam_oddjob_mkhomedir is enabled (umask=0077)
Always authorize local users is enabled ()

Changing password for users is now simple as:

ldapuser@centos ~ % passwd
Changing password for user ldapuser.
(current) LDAP Password: 
New password: 
Retype new password: 
passwd: all authentication tokens updated successfully.
ldapuser@centos ~ %
  • Thank you for pointing me in a direction I haven't looked at yet. Howver, I still need a little help. (See question edit above). – Woltan Oct 2 '16 at 11:12
  • Thank you for your the edit of your answer! Without running the authconfig command I have in authconfig --test the exact same output as you have listed in your answer. The passwd changes the password just like you printed in your answer, but I still cannot login the other machines with the new password but only the old one. Do you have any idea what still míght be going wrong here? – Woltan Oct 4 '16 at 5:06
  • the authconfig --test lead me to a possible issue as stated in the Edit2 part of my qustion above. Also is there a way of running authconfig without permanently loosing all current configurations? Like, some way of backing up the current configuration? – Woltan Oct 4 '16 at 5:57
  • 1
    For authconfig the --backup option is available, IIRC – Xalorous Oct 5 '16 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.