LDAP: Cannot change user password

oldrock

这是转贴https://secure.experts-exchange. ... 1138520&rsid=60，
这个问题我也碰到了，大家有什么建议？

I recently activated LDAP on Solaris 9 and I am running into a user password problem.

Basically, I used "idsconfig" to create the domain.  I used "ldapaddent -f /etc/passwd" to create all the users within the LDAP database...but LDAP is not able to identify or change a user password.  

To make troubleshooting easier, I did the following to create a user which is UNIQUE to LDAP (and NOT in the /etc/passwd) ...

1. I created the user "ldapuser" within LDAP with the "ldapaddent" command and used a modified entry from the /etc/passwd (NOTE: LDAPUSER DOES NOT APPEAR IN THE /ETC/PASSWD!)

2. LDAP successfully SEES the new user, since when I enter "su - ldapuser" I successfully su to “ldapuser” and go to correct dir.

3. However, if I "rlogin server1 -l ldapuser" and enter what SHOULD be the password, it simply fails to login (as if I got the password wrong.)

4. I used the “/usr/sbin/directoryserver startconsole” to start the LDAP management console, found the user, and entered a password here.  HOWEVER, when I go back and do step three I get the same results.

5. If I try the command (as root) “passwd –r ldap ldapuser”…I get the following response…
  Enter root's password: <entered correctly>
  New Password: <entered correctly>
  Re-enter new Password: <entered correctly>
  passwd: System error: no ldap password for ldapuser.
  Permission denied

6. I AM able to login into the LDAP Management Console using username:ldapuser and the password I assigned it, but when I try the command (as ldapuser) “passwd –r ldap ldapuser”…I get the following response…
  Enter existing login password: <blank>
  passwd: Sorry, wrong passwd
  Permission denied
  $ passwd -r ldap ldapuser
  Enter existing login password: <password entered in at the management console>
  passwd: Sorry, wrong passwd
  Permission denied

I’M STUCK!  HELP!
Thanks!

oldrock

现在能从root su到该ldap用户，也能在root下通过 passwd -r ldap 来修改该ldap用户的密码，
但假如直接用该ldap用户来登陆，就不行。
感觉好像是系统在匹配密码的时候没去找ldap server，各位觉得呢？

py

pam的配置有问题, pam的配置文件中的参数以及认证模块的顺序很重要.

oldrock

多谢py，解决了，是少了 -a credentialLevel=proxy，
所以一直取不到ldap server上的passwd

szptzhu

最近我也要通过ldap修改用户密码，可否发些相关例子给我。
$sr=ldap_search($ds,"dc=v4cluster,dc=com","(uid=$username)"); //check the db again, this time so we get the password field returned
                $info = ldap_get_entries($ds, $sr);
                $storedpass=$info[0]['userpassword'][0];
不知为什么　$storedpass为空

szptzhu

最近我也要通过ldap修改用户密码，可否发些相关例子给我。
$sr=ldap_search($ds,"dc=v4cluster,dc=com","(uid=$username)"); //check the db again, this time so we get the password field returned
                $info = ldap_get_entries($ds, $sr);
                $storedpass=$info[0]['userpassword'][0];
不知为什么　$storedpass为空

我的邮箱　cooler26412915@163.com QQ:50187147