Am 2018-08-30 00:48, schrieb William Brown:
On Wed, 2018-08-22 at 12:41 +0200, rainer(a)ultra-secure.de wrote:
> Hi,
>
> I have a few users in my open-ds dump that have the following
> attribute:
>
> ds-privilege-name: password-reset
>
>
> Does something like this exist in 389-server or is it done purely on
> an
> ACI level?
If I recall correctly, if you have the write targetattr userPassword,
you can reset someone's password. I think this is a good example where
we need to document this better as password reset is a common
requriement.
I've CCed on our documentation wizard who may know where this is found,
or where it should be added.
Hi,
thanks for the feedback.
I used "Passwd Admins" feature.
dn: cn=Passwd Admins,dc=the,dc=domain,dc=ch
changetype: add
objectClass: top
objectClass: groupOfUniqueNames
cn: PasswordAdminsGroup
description: Users in this group can change passwords
uniqueMember: cn=TechUser,dc=the,dc=domain,dc=ch
uniqueMember: cn=reg,dc=appusers,dc=the,dc=domain,dc=ch
dn: cn=config
changetype: modify
replace: passwordAdminDN
passwordAdminDN: cn=Passwd Admins,dc=the,dc=domain,dc=ch
These two users had the ds-privilege-name: password-reset attribute
Is that correct?
Best Regards
Rainer