Re: Scratching my head over passwd->LDAP

On 6 Jun 2006, at 22:24, Collins, Kevin [MindWorks] wrote:
> 	I'm not aware of the traditional passwd command working anywhere
> with LDAP. Use 'ldappasswd'...

passwd is fully PAM enabled. A password change evokes the PAM  
password service, which does whatever you configure it to do. In my  
case that is attempt a Kerberos password change against AD, if not  
fall back to an LDAPS password change.

To quote the PAM manpage:

"      password - this group's responsibility is the task of  
updating  authen-
        tication	 mechanisms.  Typically, such services are strongly  
coupled to
        those of the auth group. Some authentication mechanisms lend  
themselves
        well  to	 being	updated	 with such a function. Standard UN*X  
password-
        based access is the obvious example: please enter a   
replacement	 pass-
        word."

Out of interest, what did you think this PAM directive was for?

Just because you don't know about it doesn't mean it can't happen...  
Book a flight to London and I'll demo a password change on my Linux  
workstation and Windows desktop for you ;o)

--
Sam