Re: Scratching my head over passwd->LDAP

On 6/6/06, Doug Stewart wrote:
> 1) I can't get passwd to correctly interact with the OD/LDAP server in
> order to allow users to change their own passwords.  I suspect that
> there will need to be some pam tweaking, but I've not been able to
> determine the precise recipe for such as of yet.  Does anyone have a
> nice step-by-step to make passwd Just Work(tm) for LDAP environments?

We have a slightly different setup, using OpenLDAP. The pam changes
are made at install with kickstart's "authconfig enableldapauth" and then
custom /etc/ldap.conf and /etc/openldap/ldap.conf files are created.
I'm guessing this might work for you though since we can authenticate
MacOS 10.4 Tiger clients. Also, an important thing is that since we are
using SSL the /etc/ldap.secret file should NOT exist (though it produces
warnings).

Our RHEL users can definitely change their own passwords.

authconfig --enableshadow --enablemd5 --enableldap
--ldapserver=ldaps://ldap1.biostr.washington.edu
--ldapbasedn="dc=sig,dc=biostr,dc=washington,dc=edu" --enableldapauth
--enableldaptls --enablecache --disablenis --kickstart
cat > /etc/ldap.conf << EOF
uri             ldaps://ldap1.biostr.washington.edu
ldaps://ldap2.biostr.washington.edu
ssl             on
tls_cacertfile  /usr/share/ssl/certs/ca-bundle.crt
tls_checkpeer   yes
ldap_version    3
scope           one
rootbinddn      cn=admin,dc=sig,dc=biostr,dc=washington,dc=edu
base            dc=sig,dc=biostr,dc=washington,dc=edu
nss_base_passwd ou=People,dc=sig,dc=biostr,dc=washington,dc=edu
nss_base_shadow ou=People,dc=sig,dc=biostr,dc=washington,dc=edu
nss_base_group  ou=Group,dc=sig,dc=biostr,dc=washington,dc=edu
pam_password    exop
EOF
cat > /etc/openldap/ldap.conf << EOF
URI  ldaps://ldap1.biostr.washington.edu ldaps://ldap2.biostr.washington.edu
BASE dc=sig,dc=biostr,dc=washington,dc=edu
TLS_CACERT /usr/share/ssl/certs/ca-bundle.crt
TLS hard
TLS_REQCERT demand
EOF