You can allow users to change their own passwords by updating the access control list and
granting users write access to the userpassword attribute.
Procedure
-
Add a special ACL to the suffix level entry by using the following command:
idsldapmodify -p <port> -D <bindDN> -w
<bindPassword> -i <input file>
where input ldif file contains the following
entry:
dn: o=sample
changetype: modify
add: aclentry
aclentry: access-id:cn=this:at.userpassword:rwsc
-
add: aclentry
aclentry: group:cn=anybody:normal:rwsc:system:rsc:restricted:rsc
In the example, suffix or top of the tree is o=sample.
This ldif file is used to modify ACL to add cn=this for
userpassword attribute with read or write access. The bind user has access to
their own userpassword attribute and adds back the default
cn=anybody access that goes away when you set a new ACL.
Note: Before adding this ACL to the instance, run the command below and capture the current ACL's to
a text file for future reference.
idsldapsearch -p <port> -D <bindDN> -w
<bindPassword> -b <base DN> -s base objectclass=* +ibmacia
- If the Directory Server PwdPolicy is being used, then you also
must set the PwdPolicy attribute in
"cn=pwdpolicy,cn=ibmpolicies" OR any specific user or group based password
policies: pwdAllowUserChange = True