Can't update user password - Permission denied

Question

Hi,
having problem with user passwords in LDAP - they can't update them. Error message is Permission denied.
Login with auto_home (NFS mounted homedir) to an ldap-client for an ldap user works.
Using proxy auth, see below:
#ldapclient list
NS_LDAP_FILE_VERSION= 2.0
NS_LDAP_BINDDN= cn=proxyagent,ou=profile,dc=XXXX,dc=xxxx
NS_LDAP_BINDPASSWD= {NS1}3d49523a8533bcb5a4
NS_LDAP_SERVERS= x.x.x.x x.x.x.x
NS_LDAP_SEARCH_BASEDN= dc= XXXX,dc=xxxx
NS_LDAP_AUTH= simple
NS_LDAP_SEARCH_REF= FALSE
NS_LDAP_SEARCH_SCOPE= one
NS_LDAP_SEARCH_TIME= 30
NS_LDAP_CACHETTL= 43200
NS_LDAP_PROFILE= default
NS_LDAP_CREDENTIAL_LEVEL= proxy
NS_LDAP_BIND_TIME= 10
Do I need to add anything to pam.conf - ('password' section)? or is it an missing ACI?
Reg Henrik

Answer 1

I'm having this same problem and thought I'd poke this to see if I can get any more help -
Does anyone have a sample of what the ACIs should look like? The only ACIs I have is what ISW itself installed
I can log in as a user just fine.
passwd cdavis15
Enter cdavis15's password:
New Password:
Re-enter new Password:
Permission denied
If I do an ldapsearch as that user to see his own information I see:
ldap_init( server, 389 )
filter pattern: uid=cdavis15
returning: ALL
filter is: (uid=cdavis15)
ldap_search: DSA is unwilling to perform
ldap_search: addition info: Password was reset and must be changed
0 matches
The ACI that ISW installed that seem related to what was suggested here:
targetattr="userPassword")(version 3.0;acl "allow userpassword self modification"; allow (write) userdn = "ldap:///self";)
Any help appreciated.