[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: How To set things up to allow users to change their passwords
At Sat, 05 Dec 2009 19:41:26 +0100 Zdenek Styblik <stybla@turnovfree.net> wrote:
>
> Robert Heller wrote:
> > At Sat, 05 Dec 2009 18:29:55 +0100 Zdenek Styblik <stybla@turnovfree.net> wrote:
> >
> >> Robert Heller wrote:
> >>> At Sat, 05 Dec 2009 09:12:46 +0100 "Dieter Kluenter" <dieter@dkluenter.de> wrote:
> >>>
> >>>> Robert Heller <heller@deepsoft.com> writes:
> >>>>
> >>>>> I have Openldap set up on a CentOS 5 system (using the stock 2.3.43
> >>>>> RPMS) and I want to allow users to change their passwords, but I am
> >>>>> confused by the documentation (it has both too much and not enough
> >>>>> information -- there don't appear to be simple HowTos for common setups).
> >>>> http://www.openldap.org/doc/admin24/slapdconfig.html
> >>>> see section 6.3
> >>> OK, I have set this up, and with some poking around I have gained a
> >>> better unterstanding of what is going on. I have another question:
> >>>
> >>> In the sample config it has an access control list that looks like:
> >>>
> >>> access to attrs=userPassword
> >>> by self write
> >>> by anonymous auth
> >>> by dn.base="cn=Admin,dc=example,dc=com" write
> >>> by * none
> >>>
> >>> Where does the password for "cn=Admin,dc=example,dc=com" exist? Is this
> >>> something a add to slapd.config or insert into the database or ???
> >>>
> >> Evening,
> >>
> >> -- SNIP ---
> >> # cat /etc/openldap/slapd.conf
> >> ...
> >> rootdn "cn=Manager,dc=domain,dc=tld"
> >> rootpw {SSHA}blahBlahHash
> >
> > It already has a rootdn/rootpw, much like the sample one
>
> Should we have a crystal ball? You haven't shown us a bit of your
> configs and expecting miracles?
Basically pretty much straight from section 6.3 of the Admin guide.
> Yes, I'm being rude. Yes, I found your question as a "basic know-how"
> thing. Also, whole thing can be studied in many books out there. And
> believe it, it's not that much to read.
I've *been* reading the admin guide. It is just not clear to me.
> Also, if you are looking for some very specific how-to which is going to
> be tailored specially for you, I somewhat resigned on such ideas. But
> yeah, I'm no surprised. There are also Bubuntu, Debian, etc. how-tos
> [oh, well - google?].
I'm using CentOS (RHEL).
> If you don't want to waste time with setting up OpenLDAP, which you
> should if you're real about using it, then pay somebody. There are
> companies doing it for living.
>
> >(in section
> > 6.3) for 'cn=Manager,dc=example,dc=com', the sample slapd.config has this also.
> > The slapd.config in section 6.3 *ALSO* refers to the DN
> > "cn=Admin,dc=example,dc=com", which is *PRESUMABLY* separate from
> > "cn=Manager,dc=example,dc=com". How do a specify a password for this
> > *OTHER* DN?
>
> You will use % slappasswd; to generate HASH password. Then, you will use
> % ldapadd; or % ldapmod;, to add new user entry with DN:
> 'cn=Admin,dc=example,dc=com'. Please, do read manual pages for those, or
> some books about LDIF.
I've read the docs, they just don't seem clear.
>
> > Or is the slapd.conf in section 6.3 just being gratiously
> > confusing for no good reason?
>
> Well, that's possible. It's been written by people. If there are
> mistakes, please, point them out (ideally with appropriate fixes), so
> they can be fixed/clarified. Yeah, Admin's guide isn't perfect. In a
> fact, some sections are missing, or lack information.
>
> > I understand that the rootdn was write
> > access to everything, no matter what the ACLs say. I presuming that the
> > ACL with "cn=Admin,dc=example,dc=com" is to allow someone else access to
> > updating accounts. How do I set this other person's password? Is this
> > in the database, slapd.conf or ldap.conf or someplace else?
> >
>
> Use % ldapmod;.
>
> >> -----------
> >>
> >> Regards,
> >> Zdenek
> >>
> >
>
> Zdenek
>
--
Robert Heller -- 978-544-6933
Deepwoods Software -- Download the Model Railroad System
http://www.deepsoft.com/ -- Binaries for Linux and MS-Windows
heller@deepsoft.com -- http://www.deepsoft.com/ModelRailroadSystem/