On 10/19/18 7:43 AM, Thomas Höll via FreeIPA-users wrote:Hi All,I've been building a password self service application which talks tothe FreeIPA REST API to reset a user's password. This is workingperfectly when I use the 'admin' user to perform the operation, but Idon't want to do that in production because of reasons.So I've created a dedicated service account and assigned the role'helpdesk' (I've also tried 'User Administrator'). I can performchanges like modifying another user's email address, but I can't resetthe password.The error is:code=2100message=Insufficient access: Insufficient 'write' privilege to the 'userPassword' attribute of entry 'uid=XXXXXXXXX'.data={info=Insufficient 'write' privilege to the 'userPassword' attribute of entry 'uid=tho,cn=users,cn=accounts,dc=ipa,dc=diges,dc=org'.}name=ACIErrorAny ideas?Hi Thomas,The 'helpdesk' role should be sufficient to reset another user'spassword because it contains the privilege 'Modify Users and Resetpasswords' which in turns grants the permission 'System: Change Userpassword'.I did the following and it's working:(create a special user 'pwdchger' with helpdesk role)# kinit admin# ipa user-add pwdchger --first pwdchger --last pwdchger --password# ipa role-add-member helpdesk --users pwdchger(authenticate as this user and change another user's pwd)# kinit pwdchger# ipa user-mod test --passwordPassword:Enter Password again to verify:--------------------Modified user "test"--------------------User login: testFirst name: testLast name: testHome directory: /home/testLogin shell: /bin/shPrincipal name: test@DOMAIN.COMPrincipal alias: test@DOMAIN.COMEmail address: test@domain.comUID: 411000001GID: 411000001Account disabled: FalsePassword: TrueMember of groups: ipausersKerberos keys available: True#(also working with ipa passwd)# ipa passwd testNew Password:Enter New Password again to verify:------------------------------------------------------------------Changed password for "test@DOMAIN.COM"------------------------------------------------------------------If you are using the API, you should get the same result, provided thatthe right user is authenticated. You can check in/var/log/httpd/error_log which user is performing the call:when pwdchger tries to change 'test' password:ipa: INFO: [jsonserver_kerb] pwdchger@DOMAIN.COM: user_mod/1(u'test',userpassword=u'********', version=u'2.229'): SUCCESSor when test tries to change 'pwdchger' password:ipa: INFO: [jsonserver_kerb] test@DOMAIN.COM: user_mod/1(u'pwdchger',userpassword=u'********', version=u'2.229'): ACIErrorHTH,floRegards,Thomas_______________________________________________FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.orgTo unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.orgFedora Code of Conduct: https://getfedora.org/code-of-conduct.htmlList Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelinesList Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
--
NeosIT GmbH
Wir schaffen IT, die die Welt ein Stück einfacher macht.
Schachtweg 1
38440 Wolfsburg
Tel. +49 5361 83494-23
Fax +49 5361 83494-94
mailto:thomas.hoell@neos-it.de
Handelsregister: Amtsgericht Braunschweig, HRB 203557
Geschäftsführer: Sebastian Schier