Florence Blanc-Renaud via FreeIPA-users wrote:
On 10/19/18 7:43 AM, Thomas Höll via FreeIPA-users wrote:
> Hi All,
>
> I've been building a password self service application which talks to
> the FreeIPA REST API to reset a user's password. This is working
> perfectly when I use the 'admin' user to perform the operation, but I
> don't want to do that in production because of reasons.
>
> So I've created a dedicated service account and assigned the role
> 'helpdesk' (I've also tried 'User Administrator'). I can perform
> changes like modifying another user's email address, but I can't reset
> the password.
>
> The error is:
> code=2100
> message=Insufficient access: Insufficient 'write' privilege to the
> 'userPassword' attribute of entry 'uid=XXXXXXXXX'.
> data={info=Insufficient 'write' privilege to the 'userPassword'
> attribute of entry
> 'uid=tho,cn=users,cn=accounts,dc=ipa,dc=diges,dc=org'.}
> name=ACIError
>
> Any ideas?
>
Hi Thomas,
The 'helpdesk' role should be sufficient to reset another user's
password because it contains the privilege 'Modify Users and Reset
passwords' which in turns grants the permission 'System: Change User
password'.
I did the following and it's working:
(create a special user 'pwdchger' with helpdesk role)
# kinit admin
# ipa user-add pwdchger --first pwdchger --last pwdchger --password
# ipa role-add-member helpdesk --users pwdchger
(authenticate as this user and change another user's pwd)
# kinit pwdchger
# ipa user-mod test --password
Password:
Enter Password again to verify:
--------------------
Modified user "test"
--------------------
User login: test
First name: test
Last name: test
Home directory: /home/test
Login shell: /bin/sh
Principal name: test(a)DOMAIN.COM
Principal alias: test(a)DOMAIN.COM
Email address: test(a)domain.com
UID: 411000001
GID: 411000001
Account disabled: False
Password: True
Member of groups: ipausers
Kerberos keys available: True
#
(also working with ipa passwd)
# ipa passwd test
New Password:
Enter New Password again to verify:
------------------------------------------------------------------
Changed password for "test(a)DOMAIN.COM"
------------------------------------------------------------------
If you are using the API, you should get the same result, provided that
the right user is authenticated. You can check in
/var/log/httpd/error_log which user is performing the call:
when pwdchger tries to change 'test' password:
ipa: INFO: [jsonserver_kerb] pwdchger(a)DOMAIN.COM: user_mod/1(u'test',
userpassword=u'********', version=u'2.229'): SUCCESS
or when test tries to change 'pwdchger' password:
ipa: INFO: [jsonserver_kerb] test(a)DOMAIN.COM: user_mod/1(u'pwdchger',
userpassword=u'********', version=u'2.229'): ACIError
He's using a sysaccount which presently cannot be added to a role. The
trade-off is having a real POSIX user being this interface or an
LDAP-only bind account. It is possible to manually add memberOf= to the
entry to give it the read/write permissions it needs.
Note that we recently became aware of
https://github.com/larrabee/freeipa-password-reset
This isn't an endorsement, we haven't evaluated it yet, but it seems
like they are covering similar ground.
rob