I see tn the docs that you can make a Password Administrators group, like so:
dn: cn=config changetype: modify replace: passwordAdminDN passwordAdminDN: cn=Passwd Admins,ou=groups,dc=example,dc=com
I'm curious though, what privileges does a Directory Administrator have over and above one of these Password Administrators.
Hi,
I assume your question is about privileges 'Directory manager' vs 'Password Administrators'.
They are both allowed to bypass the password policy (global or local) and set any value they want. While 'Directory manager' does not need specific ACI, Administrators belonging to 'passwordAdminDN' group do need ACIs granting read/write on password attributes [1]
[1] https://www.port389.org/docs/389ds/design/password-administrator.html
best regards thierry
On 3/16/24 00:04, tdarby@arizona.edu wrote:
I see tn the docs that you can make a Password Administrators group, like so:
dn: cn=config changetype: modify replace: passwordAdminDN passwordAdminDN: cn=Passwd Admins,ou=groups,dc=example,dc=com
I'm curious though, what privileges does a Directory Administrator have over and above one of these Password Administrators.
389-users mailing list -- 389-users@lists.fedoraproject.org To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
389-users@lists.fedoraproject.org
-
tdarby＠arizona.edu -
Thierry Bordaz