https://pagure.io/SSSD/docs/pull-request/77
.. highlight:: none
Change password on LDAP server that does not support Password Mofify
Extended Operation
=======================================================================================
Related ticket(s):
------------------
https://pagure.io/SSSD/sssd/issue/1314
Problem statement
-----------------
Some directory servers either do not support Password Mofify Extended
Operation
(OID 1.3.6.1.4.1.4203.1.11.1, RFC 3062) for password change or this
feature is
disabled by default. SSSD is unable to perform password change on such
servers.
Even though we recommend to upgrade to servers that supports this feature,
there are still users that will benefit from SSSD being able to change
password without it.
Use cases
---------
* A user wants to change his/her password against LDAP that does not
support
Password Modify Extended Operation.
Overview of the solution
------------------------
Provide new configuration option ``ldap_pwmodify_exop`` that will default
to true (use extended operation for password change). If this options is set
to false, SSSD will use simple LDAP modify operation instead of extended
operation.
Implementation details
----------------------
When a password change is requested, ``sdap_pam_chpass_handler_send`` is
called.
This request first authenticates the user with current password and then in
``sdap_pam_chpass_handler_auth_done`` tries to change it with extended
operation
by calling ``sdap_exop_modify_passwd_send``. At this point we should check
the value of ``ldap_pwmodify_exop`` option and decide whether to
continue with
extended operation or use ``ldap_modify_ext`` instead.
Information on how to change the password using simple LDAP modify operation
can be found `here
<
https://www.ibm.com/support/knowledgecenter/SSVJJU_6.3.0/com.ibm.IBMDS.do...
Configuration changes
---------------------
* New option: ``ldap_pwmodify_exop``
How To Test
-----------
Set ``ldap_pwmodify_exop`` to false and try to change user's password.
Authors
-------
* Pavel Březina <pbrezina(a)redhat.com>