Hello,
I've changed my acl like this: access to attrs=userPassword,shadowLastChange,sambaNTPassword,sambaLMPassword,sambaPwdLastSet,sambaPwdMustChange by dn="cn=nssldap,ou=DSA,dc=moldex,dc=group" write by anonymous auth by self write
access to * by self write by * read
and still get. => access_allowed: read access to "uid=techsupport,ou=Users,dc=moldex,dc=group" "userPassword" requested => acl_get: [1] attr userPassword => slap_access_allowed: result not in cache (userPassword) => acl_mask: access to entry "uid=techsupport,ou=Users,dc=moldex,dc=group", attr "userPassword" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: cn=nssldap,ou=dsa,dc=moldex,dc=group <= check a_dn_pat: self <= check a_dn_pat: anonymous <= acl_mask: [3] applying auth(=xd) (stop) <= acl_mask: [3] mask: auth(=xd) => slap_access_allowed: read access denied by auth(=xd) => access_allowed: no more rules
this only happend if smbk5pwd is enabled. My pam_ldap config looks like this: base dc=moldex,dc=group uri ldap://127.0.0.1 ldap_version 3 rootdn cn=nssldap,ou=dsa,dc=moldex,dc=group referrals yes timelimit 30 bind_timelimit 30 bind_policy hard nss_reconnect_tries 1 nss_reconnect_sleeptime 1 nss_reconnect_maxsleeptime 2 nss_reconnect_maxconntries 1 nss_base_passwd ou=Users,dc=moldex,dc=group?one nss_base_passwd ou=Computers,dc=moldex,dc=group?one nss_base_shadow ou=Users,dc=moldex,dc=group?one nss_base_group ou=Groups,dc=moldex,dc=group?one nss_initgroups_ignoreusers backup,bin,daemon,dhcp,games,gnats,irc,klog,libuuid,list,lp,mail,man,news,openldap,proxy,root,sshd,sync,sys,syslog,uucp,www-data
ssl off pam_lookup_policy yes pam_password exop
Thanks, greek
--- On Sat, 7/26/08, Dieter Kluenter dieter@dkluenter.de wrote: From: Dieter Kluenter dieter@dkluenter.de Subject: Re: ppolicy pwdReset To: openldap-software@openldap.org Date: Saturday, July 26, 2008, 5:28 PM
greek ordono grexk@yahoo.com writes:
I'm getting this error:
=> access_allowed: read access to
"uid=techsupport,ou=Users,dc=moldex,dc=group" "userPassword" requested
=> acl_get: [1] attr userPassword
=> slap_access_allowed: result not in cache (userPassword)
=> acl_mask: access to entry
"uid=techsupport,ou=Users,dc=moldex,dc=group", attr "userPassword" requested
=> acl_mask: to value by "", (=0)
<= check a_dn_pat: cn=replicator,ou=dsa,dc=moldex,dc=group
<= check a_dn_pat: *
<= acl_mask: [2] applying +0 (break)
<= acl_mask: [2] mask: =0
=> acl_get: [2] attr userPassword
=> slap_access_allowed: result not in cache (userPassword)
=> acl_mask: access to entry
"uid=techsupport,ou=Users,dc=moldex,dc=group", attr "userPassword" requested
=> acl_mask: to value by "", (=0)
<= check a_dn_pat: cn=samba,ou=dsa,dc=moldex,dc=group
<= check a_dn_pat: cn=nssldap,ou=dsa,dc=moldex,dc=group
<= check a_dn_pat: cn=squid,ou=dsa,dc=moldex,dc=group
<= check a_dn_pat: self
<= check a_dn_pat: anonymous
<= acl_mask: [5] applying auth(=xd) (stop)
<= acl_mask: [5] mask: auth(=xd)
=> slap_access_allowed: read access denied by auth(=xd)
=> access_allowed: no more rules
send_search_entry: conn 9 access to attribute userPassword, value #0 not
allowed
For this search your rule no. 5 is applicable, and this rule disallows read access to attribute userPassword. Change your access rules accordingly.
-Dieter
greek ordono grexk@yahoo.com writes:
Hello,
I've changed my acl like this: access to attrs=userPassword,shadowLastChange,sambaNTPassword,sambaLMPassword,sambaPwdLastSet,sambaPwdMustChange by dn="cn=nssldap,ou=DSA,dc=moldex,dc=group" write by anonymous auth by self write
access to * by self write by * read
<= acl_mask: [3] applying auth(=xd) (stop) <= acl_mask: [3] mask: auth(=xd) => slap_access_allowed: read access denied by auth(=xd) => access_allowed: no more rules
The answer is obvious, your rule "by anonymous auth" is applied. You should prabably read http://www.openldap.org/faq/data/cache/189.html in order to design access rules
-Dieter
Hi,
Ok, I'll just read again that FAQ. Check this complete log of ppolicy with/without smbk5pwd overlay. Or maybe just another pam_ldap bug
1. change passwd before entering new password # passwd techsupport Enter login(LDAP) password:
smbk5pwd+ppolicy log: http://pastebin.com/m7dce205a ppolicy log: http://pastebin.com/m18f72eb6
2. enter new password New password: Re-enter new password: LDAP password information update failed: Insufficient access Operations are restricted to bind/unbind/abandon/StartTLS/modify password passwd: Permission denied passwd: password unchanged
smbk5pwd+ppolicy log: http://pastebin.com/m4f98884e ppolicy log: http://pastebin.com/m2fe93f63
If you look into step 1 anomymous is applied as well, without smbk5pwd and pwdReset update is successful. In step 2 there you can see the difference, if its acl problem can someone suggest a working acl(minimal) with smbk5pwd+ppolicy+pwdReset...
thanks grexk --- On Mon, 7/28/08, Dieter Kluenter dieter@dkluenter.de wrote: From: Dieter Kluenter dieter@dkluenter.de Subject: Re: ppolicy pwdReset To: openldap-software@openldap.org Date: Monday, July 28, 2008, 3:06 PM
greek ordono grexk@yahoo.com writes:
Hello,
I've changed my acl like this:
access to
attrs=userPassword,shadowLastChange,sambaNTPassword,sambaLMPassword,sambaPwdLastSet,sambaPwdMustChange
by dn="cn=nssldap,ou=DSA,dc=moldex,dc=group" write
by anonymous auth
by self write
access to *
by self write
by * read
<= acl_mask: [3] applying auth(=xd) (stop)
<= acl_mask: [3] mask: auth(=xd)
=> slap_access_allowed: read access denied by auth(=xd)
=> access_allowed: no more rules
The answer is obvious, your rule "by anonymous auth" is applied. You should prabably read http://www.openldap.org/faq/data/cache/189.html in order to design access rules
-Dieter
openldap-software@openldap.org
-
Dieter Kluenter -
greek ordono