Re: access permissions

[Adam Williams <awilliam@mdah.state.ms.us>]

Quanah Gibson-Mount wrote:
> Well, in your above example here, ADAM binds as TESTUSER not as ADAM, 
> and so is able to change TESTUSERs password.  I see no problem with 
> your ACLs, only your test.  I.e., all you have proven is that testuser 
> can change their own password.
>
> The correct test would be to do:
>
> ldapmodify -D 
> "uid=adam,ou=People,dc=gomer,dc=mdah,dc=state,dc=ms,dc=us" -w xxxxx -x 
> -v -f changepasswd.ldif

Yes, I think you are right, I don't have a configuration error, just a 
logic problem in my head.  I was just seeing if I could change 
testuser's password with the same password testuser is already using.  
And adam and testuser have the same password, which would make the 
ldapmodify command succeed whether adam or testuser ran it.  I'll try 
tomorrow with a different password in changepasswd.ldif and see what 
happens.  Thanks!