mirror/openldap
2
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2025-01-06 10:46:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

add notes about pwdAllowUserChange (more about ITS#7021)

Browse Source
This commit is contained in:
Pierangelo Masarati 2011-08-20 19:02:06 -06:00
parent bdbdae3e5f
commit 3e504bcbbf
1 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
doc/man/man5/slapo-ppolicy.5
View File

@ -414,6 +414,23 @@ is set to "TRUE", or if the attribute is not present, users will be
allowed to change their own passwords. If its value is "FALSE",
users will not be allowed to change their own passwords.
.LP
Note: this implies that when
.B pwdAllowUserChange
is set to "TRUE",
users will still be able to change the password of another user,
subjected to access control.
This restriction only applies to modifications of ones's own password.
It should also be noted that
.B pwdAllowUserChange
was defined in the specification to provide rough access control
to the password attribute in implementations that do not allow fine-grain
access control.
Since OpenLDAP provides fine-grain access control, the use of this attribute
is discouraged; ACLs should be used instead
(see
.BR slapd.access (5)
for details).
.LP
.RS 4
( 1.3.6.1.4.1.42.2.27.8.1.14
NAME 'pwdAllowUserChange'