Hello Martin,

The rootdn can always change everything everywhere. So, I guess you should use the root dn to do that. You ACL simply says that only the user himself/herself can change the password.

Best regards,

Claus

________________________________

Von: openldap-technical-bounces+claus.kick=siemens.com@OpenLDAP.org [mailto:openldap-technical-bounces+claus.kick=siemens.com@OpenLDAP.org] Im Auftrag von Martin Benson Gesendet: Sonntag, 18. Mai 2008 20:17 An: openldap-technical@openldap.org Betreff: Help with ACL's for userPassword updates

Hi I need some help with the Access Control Lists in my slapd.conf file. I need to allow myself to update a user's password for when they forget their password. With no ACL's in place I can do this using a ldapmodify command that authenticates as "cn=Manager,dc=example,dc=com". I normally have the following in my ACL's:

access to attrs=userPassword by self write by anonymous auth by * none access to * by * read

What do I need to do to change this to allow the manager to change the userPassword attribute.

Thanks Martin Benson