LDAP and passwd

[Andrew Mather]

On Wed, 2004-12-15 at 18:19 +0000, mal wrote:
> Does anyone have a slapd.conf that allows users to change their own
> passwords
>
> I have LDAP working for authentication and user info and everything
> works fine except users can't change their own passwords
>
> I get a message saying can't contact LDAP server
> passwd: Permission denied
>
> Do I need to do something in /etc/pam.d

This works for me (obviously, change the xxx's to suit your dc):

access to attr="userPassword"
  by dn="uid=ldaproot,dc=xxx,dc=xxx,dc=xxx,dc=xxx" write
  by self write
  by anonymous auth
  by * search

access to *
  by dn="uid=ldaproot,dc=xxx,dc=xxx,dc=xxx,dc=xxx" write
  by * read


Andrew