Need advise!! admin password for tree

Question

We recently had an employee that has parted ways with us. I need to changed the admin edirectory password but I am afraid I might break the tree.What advise can you give. We are running OES11 sp2 edirectory 8.8 and sless 11sp3 .
Thank you

Answer 1

On 02/06/2015 08:46 AM, kjhurni wrote:
>
> IMO, it shouldn't break anything with eDirectory per se. Now, if you
True; eDirectory will be fine, but that's not the whole story, as you
continue...
> have other software that was installed and you used that credential set,
> then you may run into issues (ie, you used that account for your backup
> software, then it will fail to authenticate).
> My assumption of course, is also based upon that you do not have an
> intruder lockout setting for the Admin account. If you do, then you
> could risk locking the account and then you're kinda hosed, unless you
> have an auto-reset, or you have created another admin-equivalent (and
> there's a good way and a bad way to do that).
>
> Usually one should define another user as a Trustee of the tree with the
> explicitly assigned rights as Admin. That way if the Admin account is
> locked/deleted/whacked, you can login as that other user and do things.
> I'm not a big fan of creating another user and assigning it 'equivalent"
> rights to admin, because if something comes along and deletes the
> account or changes the Admin rights, now that account is also affected.
>
> I'm sure my other colleagues will have some other and better ideas or
> ways to figure out what's using the account to see if you're going to
> run into trouble.
>
> For example, if you use IDM and you have the drivers set to use Admin or
> something, you could be in trouble.
IDM driver security equivalence has nothing to do with passwords, or even
the ability to login (intruder stuff would not impact it) so unless a
driver config (userapp driver perhaps, or something using ECMAscript to do
LDAP things against the directory) is configured to login as the admin
user, IDM should be fine. As mentioned, though, it is a best/proven
practice to create a different object with appropriate rights for each
driver config, or each service that needs to connect back in, to avoid
other bad things (like this thread's topic, or much worse) from happening
sometime in the future.
> I'm not 100% sure if the OES11 stuff (if you used Admin) for LUM/LDAP
> Proxy stuff would be affected, or if the cronjobs will figure out the
LUM: Yes, that's probably the biggest one. If using a common proxy user
for things, then you should be fine for anything using non-admin users.
Good luck.
If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below...