Tiemen Ruiten via FreeIPA-users wrote:
As I mentioned in my first mail, that doesn't work. For testing,
I
created a new role that contains the following privileges:
Group Administrators
Modify Group membership
Modify Users and Reset passwords
User Administrators
Unfortunately, I get the same error.
What version of IPA is this? The helpdesk role should be sufficient (and
works for me).
rob
On 4 August 2017 at 17:40, Bob Rentschler <bob.rentschler(a)gmail.com
<mailto:bob.rentschler@gmail.com>> wrote:
Assigning roles to your userwill fix that issue. The existing "User
Administrator" role may fit your needs, but I am unsure how restrictive
you want to be with permissions.
If you want to be more restrictive a custom role with "System:
Change User password" permissions would seem to be the right way.
Make a privilege that contains only that permission (and and other
missing permissions down the road) add it to a new role and then
assign that role to your user.
Bob
On Fri, Aug 4, 2017 at 10:12 AM, Tiemen Ruiten via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>> wrote:
Hello,
I setup an LDAP User Federation in Keycloak to our FreeIPA
domain. Unfortunately, the password reset functionality appears
to only work when the user Keycloak binds as is in the admins
group. I tried both the User Administrator and helpdesk roles,
but always got this error:
Caused by: javax.naming.NoPermissionException: [LDAP: error code
50 - Insufficient 'write' privilege to the 'userPassword'
attribute of entry
'uid=xxxxx,cn=users,cn=accounts,dc=example,dc=com'
Is there a way to allow password resets without adding the
keycloak bind user to the admins group?
--
Tiemen Ruiten
Systems Engineer
R&D Media
_______________________________________________
FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
--
Tiemen Ruiten
Systems Engineer
R&D Media
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org