Re: ppolicy : managing passwords by another user than root - openldap-technical

5 Feb 2010


      Hi Buchan,
I'm not trying to manage password policies through php. I just had a problem to give the rights of changing passwords to a user.
i figured it out now by modifying the acl's.
Here is a sample of my slapd.conf:
...
...
...
...
...
...
>>CUT<<<<<<<<<<<<<
# Default password policy
overlay         ppolicy
ppolicy_default cn=default,ou=policies,o=others,dc=domain,dc=tld
ppolicy_hash_cleartext
overlay syncprov
syncprov-checkpoint 100 10
syncprov-sessionlog 100
# The base of your directory in database #1
suffix          "dc=domain,dc=tld"
# rootdn directive for specifying a superuser on the database. This is needed
# for syncrepl.
# rootdn          "cn=admin,dc=domain,dc=tld"
rootdn  "cn=admin,dc=domain,dc=tld"
rootpw  {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
...
...
...
...
...
...
>CUT<<<<<<<<<<<<
# org1 administrators have all the rights on the subtree ou=Users,o=org1,dc=domain,dc=tld
access to dn.subtree="ou=Users,o=org1,dc=domain,dc=tld" attrs=userPassword,shadowLastChange
        by dn="cn=admin.org1,o=others,dc=domain,dc=tld" write
        by dn="cn=admin,dc=domain,dc=tld" write
        by dn="cn=syncrepluser,o=others,dc=domain,dc=tld" read
        by anonymous auth
        by self write
        by * none
access to dn.subtree="ou=Users,o=org1,dc=domain,dc=tld"
        by dn="cn=admin.org1,o=others,dc=domain,dc=tld" manage
        by dn="cn=admin,dc=domain,dc=tld" write
        by dn="cn=syncrepluser,o=others,dc=domain,dc=tld" read
        by anonymous read
        by * none
# org2 administrators have all the rights on the subtree ou=Users,o=org2,dc=domain,dc=tld
access to dn.subtree="ou=Users,o=org2,dc=domain,dc=tld" attrs=userPassword,shadowLastChange
        by dn="cn=admin.org2,o=others,dc=domain,dc=tld" write
        by dn="cn=admin,dc=domain,dc=tld" write
        by dn="cn=syncrepluser,o=others,dc=domain,dc=tld" read
        by anonymous auth
        by self write
        by * none
access to dn.subtree="ou=Users,o=org2,dc=domain,dc=tld"
        by dn="cn=admin.org2,o=others,dc=domain,dc=tld" manage
        by dn="cn=admin,dc=domain,dc=tld" write
        by dn="cn=syncrepluser,o=others,dc=domain,dc=tld" read
        by anonymous read
        by * none
####
access to attrs=userPassword,shadowLastChange
        by dn="cn=admin,dc=domain,dc=tld" write
        by dn="cn=auth,o=others,dc=domain,dc=tld" read
        by dn="cn=syncrepluser,o=others,dc=domain,dc=tld" read
        by anonymous auth
        by self write
        by * none
And my password policy :
ldapsearch -Wx -H ldaps://ldap.domain.tld -D cn=admin,dc=domain,dc=tld -b o=others,dc=domain,dc=tld cn=default
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <o=others,dc=domain,dc=tld> with scope subtree
# filter: cn=default
# requesting: ALL
#
# default, policies, others, domain.tld
dn: cn=default,ou=policies,o=others,dc=domain,dc=tld
pwdAttribute: userPassword
pwdLockout: TRUE
pwdLockoutDuration: 10800
pwdMaxFailure: 5
objectClass: pwdPolicy
objectClass: organizationalRole
cn: default
pwdAllowUserChange: TRUE
pwdMinLength: 8
pwdMaxAge: 15552000
pwdExpireWarning: 15120000
pwdCheckQuality: 2
pwdInHistory: 4
Now it works, sorry i should have provided you more information. I'll do it next time.
Regards,
Grifith
----- Mail Original -----
De: "Buchan Milne" bgmilne@staff.telkomsa.net
À: openldap-technical@openldap.org
Cc: "Smaïne Kahlouch" smainklh@free.fr
Envoyé: Vendredi 5 Février 2010 11h02:22 GMT +01:00 Amsterdam / Berlin / Berne / Rome / Stockholm / Vienne
Objet: Re: ppolicy : managing passwords by another user than root
On Monday, 1 February 2010 21:37:11 Smaïne Kahlouch wrote:
...
Could somebody help me please ?
With what?
...
I'm asking a last time then i would have to use my root account within
my php code :/ (no secure at all)
Assuming your message is relevant to the subject of this thread, php is a dead 
end, as it has no password policy control. I have some perl scripts to manage 
password-policy changes.
Regards,
Buchan