[389-users] Re: "Directory Manager" can't change user's password; result is an inaccessible account.

On 09/23/2016 02:24 PM, Janet Houser wrote:
> Hi folks,
>
> I'm fairly new to 389-ds and I ran into an issue when trying to update
> a user's password via the command line.
>
> I was able to change a password "as" the user via the command line
> using the following syntax without issue:
>
> ldappasswd -h my389dsserver.domain.edu -p 389 -ZZ -D
> "uid=jdoe,ou=People,dc=domain,dc=edu" -w current_user_passwd -s
> new_user_passwd "uid=jdoe,ou=People,dc=domain,dc=edu"
>
> However, when I tried doing the same thing as the Directory Manager,
> it changes the password hash, but it doesn't update the password. In
> fact, after
> issuing the following command (see below), both the old and new
> passwords don't work:
>
>
> ldappasswd -h my389dsserver.domain.edu -p 389 -ZZ -D "cn=Directory
> Manager" -w directorymanager_passwd -s new_user_passwd
> "uid=jdoe,ou=People,dc=int,dc=boulder,dc=nso,dc=edu"
Do you see any error messages in /var/log/dirsrv/slapd-INSTANCE/errors?

What does this access log file log for the operation?
/var/log/dirsrv/slapd-INSTANCE/access

What happens if you run this command line?
$ ldapmodify -h my389dsserver.domain.edu -p 389 -ZZ -D "cn=Directory
Manager" -w directorymanager_passwd << EOF
dn: uid=jdoe,ou=People,dc=int,dc=boulder,dc=nso,dc=edu
changetype: modify
replace: userPassword
userPassword: new_user_passwd
EOF

Is the user's password is set to new_user_passwd?

> I found the following page,
> http://directory.fedoraproject.org/docs/389ds/design/password-administrator.html,
> but being fairly
> new to 389-ds I wasn't sure how to create/define/add the ability to be
> a password administrator to an account.
>
> Any suggestions would be appreciated.
>
> Thanks,
>
> /jh
> _______________________________________________
> 389-users mailing list -- 389-users@lists.fedoraproject.org
> To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org

_______________________________________________
389-users mailing list -- 389-users@lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org