|
Hi all, SYSTEM: NethServer-7.6.1810, a distro using Centos7.6.1810 OpenLDAP: openldap-2.4.44-21.el7_6.x86_64 Extra package: Self Service Password I am using Self Service Password with question/answer method to change the password. I store the answer in an attibute named: info. $answer_objectClass = "extensibleObject"; $answer_attribute = "info"; The original Account provider is LDAP which I want to replace with Active Directory. All the user have to choose a question/answer before I replace LDAP with AD as the Account provider. While LDAP
is still the Account provider, anybody with console access to
the server can see the question/answer using the command: dn: uid=toto,ou=People,dc=directory,dc=nh ... objectClass: posixAccount objectClass: shadowAccount objectClass: inetOrgPerson objectClass: extensibleObject shadowLastChange: 18220 userPassword:: cm9ibTEyMDQ0OQ== info: {car}Honda I created a Virtual Machine to test the scenario with 3 users. In NethServer, the original Account provider is LDAP. I did a script to extract the users and their answers to file.ldif I remove LDAP. I install Active Directory module. I import the users/groups to AD. In the importation, AD creates new passwords for the imported users. I add a section to Self Service Password for AD. I modify AD with info.ldip to include the answer. # /usr/bin/systemd-run -M nsdc -q -t /usr/bin/ldbmodify -H /var/lib/samba/private/sam.ldb /var/lib/samba/private/file.ldif Modified 3 records successfully # The users can then modify their password responding to the same question/answer they had with LDAP. All is working perfectly. PROBLEM: I cannot encrypt the answer in LDAP because when I import the users to Active Directory, it cannot reads the encrypted answer. I think that AD is using another way to encrypt/decypt? If I don't encrypt the answer, the importation to AD is working correctly. While still using LDAP as Account provider and before I change it to Active Directory, I would like to add an additional ACL so nobody can read the answer stored in "info". After googling a lot I found a way to describe the ACL. I hope it is the right way. access to attrs=info by self write by anonymous auth by group="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by * none How can I create the content of newacl.ldif file to be able to add that ACL to OpenLDAP (ldapmodify -Y EXTERNAL -H ldapi:/// -f /temp/newacl.ldif) Thank you, Drukpa |