LDAP user changes their own password

ACL permissions control is used in LDAP.

In the/etc/openldap/slapd.conf file:

## see slapd.conf (5)  for details on configuration options.# This  File should not be world readable. #include/etc/openldap/schema/corba.schemainclude/ etc/openldap/schema/core.schemainclude/etc/openldap/schema/cosine.schemainclude/etc/openldap/schema/ duaconf.schemainclude/etc/openldap/schema/dyngroup.schemainclude/etc/openldap/schema/ inetorgperson.schemainclude/etc/openldap/schema/java.schemainclude/etc/openldap/schema/misc.schemainclude/etc/ openldap/schema/nis.schemainclude/etc/openldap/schema/openldap.schemainclude/etc/openldap/schema/ ppolicy.schemainclude/etc/openldap/schema/collective.schema# allow ldapv2 client  connections.  this is not the default.allow bind_v2# do not  enable referrals until after you have a working directory#  Service and an understanding of referrals. #referraLldap://root.openldap.orgpidfile/var/run/openldap/slapd.pidargsfile/var/run/openldap/slapd.args# load  dynamic backend modules# - modulepath is architecture dependent  value  (32/64-bit system) # - back_sql.la overlay requires  openldap-server-sql package# - dyngroup.la and dynlist.la cannot be  used at the same time#modulepath /usr/lib/openldap# modulepath /usr/lib64/ Openldap# moduleload accesslog.la# moduleload auditlog.la# moduleload back_ sql.la# moduleload chain.la# moduleload collect.la# moduleload constraint.la#  moduleload dds.la# moduleload deref.la# moduleload dyngroup.la# moduleload  dynlist.la# moduleload memberof.la# moduleload pbind.la# moduleload  pcache.la# moduleload ppolicy.la# moduleload refint.la# moduleload retcode.la# moduleload rwm.la# moduleload  seqmod.la# moduleload smbk5pwd.la# moduleload sssvlv.la# moduleload syncprov.la#  moduleload translucent.la# moduleload unique.la# moduleload valsort.la#  the next three lines allow use of tls for encrypting  connections using a# dummy test certificate which you can  generate by running# /usr/libexec/openldap/generate-server-cert.sh. your client  Software may balk# at self-signed certificates, however. tlscacertificatepath /etc/openldap/certstlscertificatefile  "\" Openldap server\ "" Tlscertificatekeyfile /etc/openldap/certs/password# sample security restrictions#require  integrity protection  (prevent hijacking) #Require 112-bit  (3des or better)  encryption for updates#require 63-bit  encryption for simple bind# security ssf=1 update_ssf=112 simple_bind =64# sample access control policy: #Root  dse: allow anyone to read  it#Subschema  (sub) entry dse: allow anyone to read it#other dses: #Allow  self write access#Allow authenticated users read access#Allow  anonymous users to authenticate#directives needed to implement policy:#  access to dn.base= ""  by * read# access to dn.base= "Cn=Subschema"  by * read# the following statements that control permissions. Access to dn.subtree= "OU=PEOPLE,DC=BAWO,DC=CN"  attrs=userpassword,shadowlastchangeby dn= " CN=ADMIN,DC=BAWO,DC=CN " writeby self writeby anonymous authby *&Nbsp;read#access to attrs=uid,uidnumber,gidnumber,memberuid#by * read# if no  access controls are present, the default policy## allows anyone  and everyone to read anything but restricts# updates to  rootdn.   (e.g.,  "Access to * by * read") ## rootdn can  always read and write everything!# enable on-the-fly configuration  (CN =config) database configaccess to *by dn.exact= "gidnumber=0+uidnumber=0,cn=peercred,cn= External,cn=auth " manageby * none# enable server status monitoring  (CN =monitor) database monitoraccess to *by dn.exact= "gidnumber=0+uidnumber=0,cn=peercred,cn= External,cn=auth " read        by dn.exact=" Cn=admin,dc=bawo, DC=CN " readby * none######################################################################## database  definitions###################################################################### #databasebdbsuffix "dc=XX,dc= CN "Checkpoint1024 15rootdn" CN=ADMIN,DC=XX,DC=CN "# cleartext passwords, especially for  THE ROOTDN, SHOULD# BE AVOIDED.  SEE SLAPPASSWD (8)  and  Slapd.conf (5)  for details.# Use of strong authentication  Encouraged.rootpw123456# rootpw{crypt}ijfyncsnctbyg# the database directory must  exist prior to running slapd AND # should only be  accessible by the slapd and slap tools.# mode 700  Recommended.directory/var/lib/ldap# indices to maintain for this databaseindex  objectclass        &nBsp;              eq,presindex ou, Cn,mail,surname,givenname      eq,pres,subindex uidnumber,gidnumber, loginshell    eq,presindex uid,memberuid                      eq,pres,subindex  Nismapname,nismapentry            eq,pres,sub

After adding the above statement, you need to update the configuration file to the LDAP service.

Service SLAPD stoprm-rf/etc/openldap/slapd.d/chown-r ldap:ldap/var/lib/ldapchown-r ldap:ldap/etc/openldap/# To test and generate the configuration file: slaptest-f/etc/openldap/slapd.conf-f/etc/openldap/slapd.d# returns config for file testing succeeded, the configuration is successful. Chown-r Ldap:ldap/etc/openldap/slapd.dservice SLAPD Restart

Once completed, the LDAP permissions are set successfully. Users can modify their own password in the phpldapadmin.

Other setup items can be explored on their own.

Additional Permission Settings Reference

Http://www.openldap.org/doc/admin24/access-control.html

slapd.conf file Configuration

LDAP Configuration detailed explanation

This article is from the "Network Computer" blog, please make sure to keep this source http://lovelinuxops.blog.51cto.com/10426562/1707732

LDAP user changes their own password