[389-users] Re: "Directory Manager" can't change user's password; result is an inaccessible account.
On 09/23/2016 03:16 PM, Janet Houser wrote: Hi Noriko, thanks for the quick response. On 9/23/16 3:37 PM, Noriko Hosoi wrote: On 09/23/2016 02:24 PM, Janet Houser wrote: Hi folks, I'm fairly new to 389-ds and I ran into an issue when trying to update a user's password via the command line. I was able to change a password "as" the user via the command line using the following syntax without issue: ldappasswd -h my389dsserver.domain.edu -p 389 -ZZ -D "uid=jdoe,ou=People,dc=domain,dc=edu" -w current_user_passwd -s new_user_passwd "uid=jdoe,ou=People,dc=domain,dc=edu" However, when I tried doing the same thing as the Directory Manager, it changes the password hash, but it doesn't update the password. In fact, after issuing the following command (see below), both the old and new passwords don't work: ldappasswd -h my389dsserver.domain.edu -p 389 -ZZ -D "cn=Directory Manager" -w directorymanager_passwd -s new_user_passwd "uid=jdoe,ou=People,dc=domain,dc=edu" Do you see any error messages in /var/log/dirsrv/slapd-INSTANCE/errors? No errors reported in /var/log/dirsrv/slapd-INSTANCE/errors when I run the ldappasswd command with "cn=Directory Manager". What does this access log file log for the operation? /var/log/dirsrv/slapd-INSTANCE/access [23/Sep/2016:15:54:44 -0600] conn=27891 fd=125 slot=125 connection from XXX.X.XX.10 to XXX.XX.XXX.4 [23/Sep/2016:15:54:44 -0600] conn=27891 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [23/Sep/2016:15:54:44 -0600] conn=27891 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [23/Sep/2016:15:54:44 -0600] conn=27891 TLS1.2 256-bit AES [23/Sep/2016:15:54:44 -0600] conn=27891 op=1 BIND dn="cn=Directory Manager" method=128 version=3 [23/Sep/2016:15:54:44 -0600] conn=27891 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager" [23/Sep/2016:15:54:44 -0600] conn=27891 op=2 EXT oid="1.3.6.1.4.1.4203.1.11.1" name="passwd_modify_extop" [23/Sep/2016:15:54:44 -0600] conn=27891 op=2 RESULT err=0 tag=120 nentries=0 etime=0 [23/Sep/2016:15:54:44 -0600] conn=27891 op=3 UNBIND [23/Sep/2016:15:54:44 -0600] conn=27891 op=3 fd=125 closed - U1 What happens if you run this command line? $ ldapmodify -h my389dsserver.domain.edu -p 389 -ZZ -D "cn=Directory Manager" -w directorymanager_passwd << EOF dn: uid=jdoe,ou=People,dc=domain,dc=edu changetype: modify replace: userPassword userPassword: new_user_passwd EOF Is the user's password is set to new_user_passwd? No, the password fails to be set, and both passwords, old and new, are now invalid. The output is: - keystrokes of issued command # ldapmodify -h my389dsserver.domain.edu -p 389 -ZZ -D "cn=Directory Manager" -w directorymanager_passwd << EOF > dn: uid=jdoe,ou=People,dc=domain,dc=edu > changetype: modify > replace: userPassword > userPassword: 123abc!@garbage > EOF modifying entry "uid=jdoe,ou=People,dc=domain,dc=edu" --- end of output --- I'm puzzled. So, it "acts" like it changes the password by telling me it is "modifying the entry", but it inserts something into the password because the old password and the new password don't work. Hi Janet, Could you tell us how you are testing the new password? Thanks for your help on this I found the following page, http://directory.fedoraproject.org/docs/389ds/design/password-administrator.html, but being fairly new to 389-ds I wasn't sure how to create/define/add the ability to be a password administrator to an account. Any suggestions would be appreciated. Thanks, /jh ___ 389-users mailing list -- 389-users@lists.fedoraproject.org To unsubscribe send an email to 389-users-le...@lists.fedoraproject.org ___ 389-users mailing list -- 389-users@lists.fedoraproject.org To unsubscribe send an email to 389-users-le...@lists.fedoraproject.org ___ 389-users mailing list -- 389-users@lists.fedoraproject.org To unsubscribe send an email to 389-users-le...@lists.fedoraproject.org ___ 389-users mailing list -- 389-users@lists.fedoraproject.org To unsubscribe send an email to 389-users-le...@lists.fedoraproject.org
[389-users] Re: "Directory Manager" can't change user's password; result is an inaccessible account.
Hi Noriko, thanks for the quick response. On 9/23/16 3:37 PM, Noriko Hosoi wrote: On 09/23/2016 02:24 PM, Janet Houser wrote: Hi folks, I'm fairly new to 389-ds and I ran into an issue when trying to update a user's password via the command line. I was able to change a password "as" the user via the command line using the following syntax without issue: ldappasswd -h my389dsserver.domain.edu -p 389 -ZZ -D "uid=jdoe,ou=People,dc=domain,dc=edu" -w current_user_passwd -s new_user_passwd "uid=jdoe,ou=People,dc=domain,dc=edu" However, when I tried doing the same thing as the Directory Manager, it changes the password hash, but it doesn't update the password. In fact, after issuing the following command (see below), both the old and new passwords don't work: ldappasswd -h my389dsserver.domain.edu -p 389 -ZZ -D "cn=Directory Manager" -w directorymanager_passwd -s new_user_passwd "uid=jdoe,ou=People,dc=domain,dc=edu" Do you see any error messages in /var/log/dirsrv/slapd-INSTANCE/errors? No errors reported in /var/log/dirsrv/slapd-INSTANCE/errors when I run the ldappasswd command with "cn=Directory Manager". What does this access log file log for the operation? /var/log/dirsrv/slapd-INSTANCE/access [23/Sep/2016:15:54:44 -0600] conn=27891 fd=125 slot=125 connection from XXX.X.XX.10 to XXX.XX.XXX.4 [23/Sep/2016:15:54:44 -0600] conn=27891 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [23/Sep/2016:15:54:44 -0600] conn=27891 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [23/Sep/2016:15:54:44 -0600] conn=27891 TLS1.2 256-bit AES [23/Sep/2016:15:54:44 -0600] conn=27891 op=1 BIND dn="cn=Directory Manager" method=128 version=3 [23/Sep/2016:15:54:44 -0600] conn=27891 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager" [23/Sep/2016:15:54:44 -0600] conn=27891 op=2 EXT oid="1.3.6.1.4.1.4203.1.11.1" name="passwd_modify_extop" [23/Sep/2016:15:54:44 -0600] conn=27891 op=2 RESULT err=0 tag=120 nentries=0 etime=0 [23/Sep/2016:15:54:44 -0600] conn=27891 op=3 UNBIND [23/Sep/2016:15:54:44 -0600] conn=27891 op=3 fd=125 closed - U1 What happens if you run this command line? $ ldapmodify -h my389dsserver.domain.edu -p 389 -ZZ -D "cn=Directory Manager" -w directorymanager_passwd << EOF dn: uid=jdoe,ou=People,dc=domain,dc=edu changetype: modify replace: userPassword userPassword: new_user_passwd EOF Is the user's password is set to new_user_passwd? No, the password fails to be set, and both passwords, old and new, are now invalid. The output is: - keystrokes of issued command # ldapmodify -h my389dsserver.domain.edu -p 389 -ZZ -D "cn=Directory Manager" -w directorymanager_passwd << EOF > dn: uid=jdoe,ou=People,dc=domain,dc=edu > changetype: modify > replace: userPassword > userPassword: 123abc!@garbage > EOF modifying entry "uid=jdoe,ou=People,dc=domain,dc=edu" --- end of output --- I'm puzzled. So, it "acts" like it changes the password by telling me it is "modifying the entry", but it inserts something into the password because the old password and the new password don't work. Thanks for your help on this I found the following page, http://directory.fedoraproject.org/docs/389ds/design/password-administrator.html, but being fairly new to 389-ds I wasn't sure how to create/define/add the ability to be a password administrator to an account. Any suggestions would be appreciated. Thanks, /jh ___ 389-users mailing list -- 389-users@lists.fedoraproject.org To unsubscribe send an email to 389-users-le...@lists.fedoraproject.org ___ 389-users mailing list -- 389-users@lists.fedoraproject.org To unsubscribe send an email to 389-users-le...@lists.fedoraproject.org ___ 389-users mailing list -- 389-users@lists.fedoraproject.org To unsubscribe send an email to 389-users-le...@lists.fedoraproject.org
[389-users] Re: "Directory Manager" can't change user's password; result is an inaccessible account.
On 09/23/2016 02:24 PM, Janet Houser wrote: Hi folks, I'm fairly new to 389-ds and I ran into an issue when trying to update a user's password via the command line. I was able to change a password "as" the user via the command line using the following syntax without issue: ldappasswd -h my389dsserver.domain.edu -p 389 -ZZ -D "uid=jdoe,ou=People,dc=domain,dc=edu" -w current_user_passwd -s new_user_passwd "uid=jdoe,ou=People,dc=domain,dc=edu" However, when I tried doing the same thing as the Directory Manager, it changes the password hash, but it doesn't update the password. In fact, after issuing the following command (see below), both the old and new passwords don't work: ldappasswd -h my389dsserver.domain.edu -p 389 -ZZ -D "cn=Directory Manager" -w directorymanager_passwd -s new_user_passwd "uid=jdoe,ou=People,dc=int,dc=boulder,dc=nso,dc=edu" Do you see any error messages in /var/log/dirsrv/slapd-INSTANCE/errors? What does this access log file log for the operation? /var/log/dirsrv/slapd-INSTANCE/access What happens if you run this command line? $ ldapmodify -h my389dsserver.domain.edu -p 389 -ZZ -D "cn=Directory Manager" -w directorymanager_passwd << EOF dn: uid=jdoe,ou=People,dc=int,dc=boulder,dc=nso,dc=edu changetype: modify replace: userPassword userPassword: new_user_passwd EOF Is the user's password is set to new_user_passwd? I found the following page, http://directory.fedoraproject.org/docs/389ds/design/password-administrator.html, but being fairly new to 389-ds I wasn't sure how to create/define/add the ability to be a password administrator to an account. Any suggestions would be appreciated. Thanks, /jh ___ 389-users mailing list -- 389-users@lists.fedoraproject.org To unsubscribe send an email to 389-users-le...@lists.fedoraproject.org ___ 389-users mailing list -- 389-users@lists.fedoraproject.org To unsubscribe send an email to 389-users-le...@lists.fedoraproject.org
[389-users] "Directory Manager" can't change user's password; result is an inaccessible account.
Hi folks, I'm fairly new to 389-ds and I ran into an issue when trying to update a user's password via the command line. I was able to change a password "as" the user via the command line using the following syntax without issue: ldappasswd -h my389dsserver.domain.edu -p 389 -ZZ -D "uid=jdoe,ou=People,dc=domain,dc=edu" -w current_user_passwd -s new_user_passwd "uid=jdoe,ou=People,dc=domain,dc=edu" However, when I tried doing the same thing as the Directory Manager, it changes the password hash, but it doesn't update the password. In fact, after issuing the following command (see below), both the old and new passwords don't work: ldappasswd -h my389dsserver.domain.edu -p 389 -ZZ -D "cn=Directory Manager" -w directorymanager_passwd -s new_user_passwd "uid=jdoe,ou=People,dc=int,dc=boulder,dc=nso,dc=edu" I found the following page, http://directory.fedoraproject.org/docs/389ds/design/password-administrator.html, but being fairly new to 389-ds I wasn't sure how to create/define/add the ability to be a password administrator to an account. Any suggestions would be appreciated. Thanks, /jh ___ 389-users mailing list -- 389-users@lists.fedoraproject.org To unsubscribe send an email to 389-users-le...@lists.fedoraproject.org
