I am unable to change a ldap user account's password as the root user.
Unfortunately after a lot of google searching I haven't had any luck.
This is happening on Centos 5.8/6.3, Fedora 16/17 machines. Thank you
for any help.
Changing password for user xxx
Password reset by root is not supported.
passwd: Authentication token manipulation error
sssd.conf:
[sssd]
config_file_version = 2
# Number of times services should attempt to reconnect in the
# event of a crash or restart before they give up
reconnection_retries = 3
# If a back end is particularly slow you can raise this timeout here
sbus_timeout = 30
services = nss, pam
domains = LOCAL,LDAP
[nss]
filter_groups = root,smolt,puppet,haclient,openvpn
filter_users = root,inoc,smolt,backup,puppet,vboxadd
reconnection_retries = 3
[pam]
reconnection_retries = 3
[domain/LOCAL]
description = LOCAL Users domain
id_provider = local
enumerate = true
min_id = 100
max_id = 10000
[domain/LDAP]
id_provider = ldap
auth_provider = ldap
ldap_schema = rfc2307
ldap_uri = ldaps://ldap.xxx.xxx
ldap_search_base = dc=xxx,dc=com
ldap_tls_reqcert = never
cache_credentials = true
enumerate = true
min_id = 100
ldap_enumeration_refresh_timeout=43200
system-auth-ac:
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet
auth sufficient pam_sss.so use_first_pass
auth required pam_deny.so
# cascading account: UNIX -> SSS
# if UNIX succeeds we pass
# if SSS succeeds we pass
# else permit
account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so md5 shadow nullok try_first_pass
use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in
crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so
session required pam_mkhomedir.so skel=/etc/skel/ umask=0022
--
David W. Jablonski | Systems Administrator | INOC | Madison, WI USA
O: +1-608-204-0202 | F: +1-608-663-4558 | djablonski(a)inoc.com |
www.inoc.com
Service. Not Software.®