使用什么命令可以验证ldap中用户的密码？

ioiioi

我已经将passwd导入ldap了，后来通过在root下使用passwd修改了用户的密码，我想知道ldap是否也自动更新？
请问用什么命令验证？

ioiioi

ldapsearch行不行？但是我man ldapsearch似乎没有要求输入用户和密码的选项。

neophiliac

Have you configured pam_ldap appropriately? Otherwise the passwd command cannot take effect on your LDAP account.
You can simply use ldapsearch with the -D option to point out a user DN and the -W option to verify the password stored in LDAP server.

ioiioi

OK, I will check out if I have configured the pam_ldap.conf
but could you give me an ldapsearch example.

1. 
   
2. ldapsearch -x -D 'uid=ldap_user,dc=example,dc=com' -W
   
3. Enter LDAP Password:
   
4. ldap_bind: Invalid DN syntac (34)
   
5.              additional info: invalid DN
   

复制代码

it seems that I typo the ldapsearch options.

[ 本帖最后由 ioiioi 于 2007-2-26 13:10 编辑 ]

neophiliac

try it:
ldapsearch -x -D "uid=ldap_user,dc=example,dc=com" -W
And double check whether the DN of uid=ldap_user,dc=example,dc=com is existent.

ioiioi

oh, I misunderstand the dn a couple minutes ago.
the dn following the option -D should be the complete dn within ldap database.
and the correct dn is 'uid=ldap_user,ou=People,dc=example,dc=com'

Authenticating the user's password depend on the ACL configuration.
so, the guy who want to accoplish authentication through this method are advised to check your /etc/ldap/slapd.conf

1. 
   
2. ----clip-----
   
3. access to attrs= *
   
4.       by anonymous auth
   
5.       by * none
   
6. ----clip-----
   

复制代码

Maybe

1. 
   
2. ----clip-----
   
3. access to attrs= *
   
4.       by * read
   
5. ----clip-----
   

复制代码

could work as well.

ioiioi

oh, I misunderstand the dn a couple minutes ago.
the dn following the option -D should be the complete dn within ldap database.
and the correct dn is 'uid=ldap_user,ou=People,dc=example,dc=com'

Authenticating the user's password depend on the ACL configuration.
so, the guy who want to accoplish authentication through this method are advised to check your /etc/ldap/slapd.conf

1. 
   
2. ----clip-----
   
3. access to attrs= *
   
4.       by anonymous auth
   
5.       by * none
   
6. ----clip-----
   

复制代码

Maybe

1. 
   
2. ----clip-----
   
3. access to attrs= *
   
4.       by * read
   
5. ----clip-----
   

复制代码

could work as well.