[Fedora-directory-users] Update user passwords with "passwd"

Mon Jan 26 16:08:32 UTC 2009

Guys,

I think i've gotten it!

So the two things that looked like I hadn't set up correctly were this:

First:

ACL's on self write. I'd locked those down so tight that I wasn't able
to actually write to my own user attribute.

Second:

The referrals under the  Configurations Tab. 
Configurations Tab -> Data -> dc=foo,dc=bar -> referrals tab

were set to refer only to ldap://master.server:389/dc=foo,dc=bar

only

Once i added a referral to port 636,  I was able to update my user
password correctly, and through the Replica!

This Documentation was helpful in getting that set up correctly!

http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Configuring_Directory_Databases-Using_Referrals.html#Using_Referrals-Creating_Suffix_Referrals

Thanks for all the help troubleshooting this everyone!

Tim

Rich Megginson wrote:
> Tim Hartmann wrote:
>> This is what I see in access from my master:
>>
>> I don't see any output from error...
>>
>>
>>
>> [23/Jan/2009:21:12:08 -0500] conn=1939 fd=67 slot=67 SSL connection from
>> 140.247.35.169 to 140.247.30.52
>> [23/Jan/2009:21:12:08 -0500] conn=1939 SSL 256-bit AES
>> [23/Jan/2009:21:12:08 -0500] conn=1939 op=0 BIND dn="" method=128
>> version=3
>> [23/Jan/2009:21:12:08 -0500] conn=1939 op=0 RESULT err=0 tag=97
>> nentries=0 etime=0 dn=""
>> [23/Jan/2009:21:12:08 -0500] conn=1939 op=1 SRCH
>> base="dc=dept,dc=school,dc=edu" scope=2
>> filter="(&(objectClass=posixAccount)(uidNumber=23030))" attrs="uid
>> userPassword uidNumber gidNumber cn homeDirectory loginShell gecos
>> description objectClass"
>> [23/Jan/2009:21:12:08 -0500] conn=1939 op=1 RESULT err=0 tag=101
>> nentries=1 etime=0
>> [23/Jan/2009:21:12:08 -0500] conn=1939 op=2 SRCH
>> base="dc=dept,dc=school,dc=edu" scope=2
>> filter="(&(objectClass=posixAccount)(uid=foo))" attrs="uid userPassword
>> uidNumber gidNumber cn homeDirectory loginShell gecos description
>> objectClass"
>> [23/Jan/2009:21:12:08 -0500] conn=1939 op=2 RESULT err=0 tag=101
>> nentries=1 etime=0
>> [23/Jan/2009:21:12:08 -0500] conn=1940 fd=68 slot=68 SSL connection from
>> 140.247.35.169 to 140.247.30.52
>> [23/Jan/2009:21:12:08 -0500] conn=1940 SSL 256-bit AES
>> [23/Jan/2009:21:12:08 -0500] conn=1940 op=0 BIND dn="" method=128
>> version=3
>> [23/Jan/2009:21:12:08 -0500] conn=1940 op=0 RESULT err=0 tag=97
>> nentries=0 etime=0 dn=""
>> [23/Jan/2009:21:12:08 -0500] conn=1940 op=1 SRCH
>> base="dc=dept,dc=school,dc=edu" scope=2 filter="(uid=foo)" attrs=ALL
>> [23/Jan/2009:21:12:08 -0500] conn=1940 op=1 RESULT err=0 tag=101
>> nentries=1 etime=0
>> [23/Jan/2009:21:12:13 -0500] conn=1940 op=2 BIND
>> dn="uid=foo,ou=People,dc=dept,dc=school,dc=edu" method=128 version=3
>> [23/Jan/2009:21:12:13 -0500] conn=1940 op=2 RESULT err=0 tag=97
>> nentries=0 etime=0 dn="uid=foo,ou=people,dc=dept,dc=school,dc=edu"
>> [23/Jan/2009:21:12:13 -0500] conn=1940 op=3 BIND dn="" method=128
>> version=3
>> [23/Jan/2009:21:12:13 -0500] conn=1940 op=3 RESULT err=0 tag=97
>> nentries=0 etime=0 dn=""
>> [23/Jan/2009:21:12:18 -0500] conn=1939 op=3 SRCH
>> base="dc=dept,dc=school,dc=edu" scope=2
>> filter="(&(objectClass=posixAccount)(uidNumber=23030))" attrs="uid
>> userPassword uidNumber gidNumber cn homeDirectory loginShell gecos
>> description objectClass"
>> [23/Jan/2009:21:12:18 -0500] conn=1939 op=3 RESULT err=0 tag=101
>> nentries=1 etime=0
>> [23/Jan/2009:21:12:21 -0500] conn=1940 op=4 BIND
>> dn="uid=foo,ou=People,dc=dept,dc=school,dc=edu" method=128 version=3
>> [23/Jan/2009:21:12:21 -0500] conn=1940 op=4 RESULT err=0 tag=97
>> nentries=0 etime=0 dn="uid=foo,ou=people,dc=dept,dc=school,dc=edu"
>> [23/Jan/2009:21:12:21 -0500] conn=1940 op=5 RESULT err=50 tag=103
>> nentries=0 etime=0
>>   
> We're missing the actual request that's causing the problem - there is
> a line for conn=1940 op=5 RESULT, but there is no line that has the
> actual operation e.g. conn=1940 op=5 MOD dn="uid=foo,..." etc.
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> George Holbert wrote:
>>  
>>> Tim Hartmann wrote:
>>>    
>>>> Hi!
>>>>
>>>> So I can into yet another pot-hole in the road to LDAP bliss...
>>>> We have a root suffix in our directory that stores the basic Posix
>>>> attributes including password,  I've been able to configure my
>>>> client to
>>>> use ldap for directory services, and authenticate against my
>>>> replica's,
>>>> so far so good! Then I tried to change my users password .. and thats
>>>> where I started getting a bit hung up..
>>>>
>>>> At first I thought that it was because my replicas weren't sending the
>>>> update request/ referrals back to the masters. (We have two masters
>>>> that
>>>> sit behind four consumers)
>>>>
>>>> Then I decided to change my ldap.conf files to point directly to my
>>>> masters.... but I still receaved the same errors "Can't contact LDAP
>>>> Server" , which was strange since I can do ldap searches against it
>>>> all
>>>> day, and even bind to the servers to do searches! and Insufficient
>>>> write
>>>> privileges, which made me think that maybe it was an ACI.. but I have
>>>> selfwrite enabled for the userPassword attribute...
>>>>
>>>> Here's the output of my failed attempt to change my user's password
>>>> after logging in successfully to the server..
>>>>
>>>> Changing password for user foo.
>>>> Enter login(LDAP) password:
>>>> New UNIX password:
>>>> Retype new UNIX password:
>>>> LDAP password information update failed: Can't contact LDAP server
>>>> Insufficient 'write' privilege to the 'userPassword' attribute of
>>>> entry
>>>> 'uid=foo,ou=people,dc=dept,dc=school,dc=edu'.
>>>>
>>>> passwd: Permission denied
>>>>
>>>>         
>>> What do your LDAP server access and error logs show at the time of the
>>> attempted password change?
>>>
>>>
>>>    
>>>> If anyone has any thought I'd be grateful! I'm pretty perplexed!
>>>>
>>>>
>>>> Best,
>>>>
>>>> Tim
>>>>
>>>>
>>>>
>>>> -- 
>>>> Fedora-directory-users mailing list
>>>> Fedora-directory-users at redhat.com
>>>> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>>>>
>>>>         
>>>
>>> -- 
>>> Fedora-directory-users mailing list
>>> Fedora-directory-users at redhat.com
>>> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>>>     
>>
>> -- 
>> Fedora-directory-users mailing list
>> Fedora-directory-users at redhat.com
>> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>>   
>
> ------------------------------------------------------------------------
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>   