Hi,
I assume your question is about privileges 'Directory manager' vs
'Password Administrators'.
They are both allowed to bypass the password policy (global or local)
and set any value they want. While 'Directory manager' does not need
specific ACI, Administrators belonging to 'passwordAdminDN' group do
need ACIs granting read/write on password attributes [1]
[1] https://www.port389.org/docs/389ds/design/password-administrator.html
best regards
thierry
On 3/16/24 00:04, tda...@arizona.edu wrote:
I see tn the docs that you can make a Password Administrators group, like so:
dn: cn=config
changetype: modify
replace: passwordAdminDN
passwordAdminDN: cn=Passwd Admins,ou=groups,dc=example,dc=com
I'm curious though, what privileges does a Directory Administrator have over
and above one of these Password Administrators.
--
_______________________________________________
389-users mailing list -- 389-users@lists.fedoraproject.org
To unsubscribe send an email to 389-users-le...@lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
--
_______________________________________________
389-users mailing list -- 389-users@lists.fedoraproject.org
To unsubscribe send an email to 389-users-le...@lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
