Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 5. Managing user passwords in IdM

Manage Identity Management (IdM) user passwords including changing your own password, resetting other users' passwords, and configuring password-related features. Control password resets, account lockouts, and authentication tracking.

5.1. Who can change IdM user passwords and how
Copy link

Regular users can change only their own passwords and must meet the password policies applicable to the groups of which the user is a member. Administrators can reset any user’s password without meeting policies, but these passwords expire on first login unless configured otherwise.

Administrators and users with password change rights can set initial passwords for new users and reset passwords for existing users. These passwords:

Note that the LDAP Directory Manager (DM) user can change user passwords using LDAP tools. A new password can override any IdM password policies. Passwords set by DM do not expire after the first login.

Additional resources

5.2. Changing your user password in the IdM Web UI
Copy link

Change your own user password in the Identity Management (IdM) Web UI to maintain account security. The new password must meet the password policies for groups you belong to.

Prerequisites

  • Your password has not expired.

Procedure

  1. Log in to the IdM Web UI.
  2. In the upper right corner, click the name of the user who is logged into the IdM Web UI.
  3. Select Change password.
  4. Enter the current password.
  5. Enter the new password in the New Password field.
  6. Confirm the new password by entering it in the Verify Password field.

  7. Click Reset Password.

    Note

    Alternatively, you can go directly to https://<server.idm.example.com>/ipa/ui/reset_password.html, and change your password there.

Reset another user’s password in the Identity Management (IdM) Web UI when they need a new password or have been locked out.

Prerequisites

  • You are logged in to the IdM Web UI as an administrative user.

Procedure

  1. Select Identity>Users.
  2. Click the name of the user to edit.
  3. Click Actions and select Reset password.
  4. Enter the new password in the New Password field.
  5. Confirm the new password by entering it in the Verify Password field.
  6. Click Reset Password.

5.4. Resetting the Directory Manager user password
Copy link

Reset the Directory Manager password if it is, for example, lost or compromised. This procedure requires root access to the Identity Management (IdM) servers and must be performed on every server in your topology.

Prerequisites

  • You have root access to all IdM servers.

Procedure

  1. On an IdM server, generate a new password hash by using the pwdhash command. For example: 

    # pwdhash -D /etc/dirsrv/slapd-IDM-EXAMPLE-COM password
{PBKDF2_SHA256}AAAgABU0bKhyjY53NcxY33ueoPjOUWtl4iyYN5uW...

    By specifying the path to the Directory Server configuration, you automatically use the password storage scheme set in the nsslapd-rootpwstoragescheme attribute to encrypt the new password.

  2. Stop all IdM services installed on the server: 

    # ipactl stop

  3. Edit the /etc/dirsrv/IDM-EXAMPLE-COM/dse.ldif file on the server and set the nsslapd-rootpw attribute to the value generated by the pwdhash command: 

    nsslapd-rootpw: {PBKDF2_SHA256}AAAgABU0bKhyjY53NcxY33ueoPjOUWtl4iyYN5uW...

  4. Start all IdM services installed on the server: 

    # ipactl start
  5. Repeat steps 2-4 on all the remaining IdM replicas in your topology.

Change your own password or reset another user’s password using the Identity Management (IdM) CLI. Administrators can reset passwords for any user while regular users can only change their own.

Prerequisites

  • You have obtained a ticket-granting ticket (TGT) for an IdM user.
  • If you are resetting another user’s password, you must have obtained a TGT for an administrative user in IdM.

Procedure

  • Enter the ipa user-mod command with the name of the user and the --password option. The command will prompt you for the new password. 

    $ ipa user-mod idm_user --password
Password:
Enter Password again to verify:
--------------------
Modified user "idm_user"
--------------------
...

    Note that you can also use the ipa passwd idm_user command instead of ipa user-mod.

Identity Management (IdM) supports multiple methods for changing user passwords, including PAM services, Kerberos, the IdM API, and LDAP. Each method has different requirements and use cases.

Expand
Table 5.1. Additional commands for changing user passwords
CommandDescriptionLimitations

passwd

A user can change their own password using PAM service facilities and the pam_sss module to interact with SSSD

The system must be enrolled in IdM and SSSD must be configured.

kpasswd

A user can change their own password directly via the Kerberos protocol

The user must have a valid Kerberos ticket (TGT); does not require system enrollment.

ipa passwd

An administrator or user can change a password through the IdM API

Requires an active Kerberos ticket and the ipa-client packages installed.

ldappasswd

An administrator or user can change a password directly via LDAP

Requires LDAP credentials (Bind DN) and direct network access to the Directory Server.

Grant specific administrators the ability to reset passwords without forcing users to change them on first login. As an Identity Management (IdM) Directory Manager, you can add administrators to the passSyncManagersDNs attribute, which allows them to perform password resets without triggering the mandatory password change requirement and optionally bypass password policy enforcement.

Warning

Bypassing the password policy can be a security threat. Exercise caution when selecting users to whom you grant these additional privileges.

Prerequisites

  • You know the Directory Manager password.

Procedure

  1. Enter the ldapmodify command to modify LDAP entries. Specify the name of the IdM server and the 389 port and press Enter: 

    $ ldapmodify -x -D "cn=Directory Manager" -W -h server.idm.example.com -p 389
Enter LDAP Password: <password>
  2. Enter the Directory Manager password.

  3. Enter the distinguished name for the ipa_pwd_extop password synchronization entry and press Enter: 

    dn: cn=ipa_pwd_extop,cn=plugins,cn=config

  4. Specify the modify type of change and press Enter: 

    changetype: modify

  5. Specify what type of modification you want LDAP to execute and to which attribute. Press Enter: 

    add: passSyncManagersDNs

  6. Specify the administrative user accounts in the passSyncManagersDNs attribute. The attribute is multi-valued. For example, to grant the admin user the password resetting powers of Directory Manager: 

    passSyncManagersDNs: \
uid=admin,cn=users,cn=accounts,dc=example,dc=com

  7. Press Enter twice to stop editing the entry.

    The admin user, listed under passSyncManagerDNs, now has the additional privileges. Repeat the steps on every Identity Management (IdM) server in the domain.

5.8. Checking if an IdM user’s account is locked
Copy link

Determine if a user’s account is locked due to failed login attempts by comparing their failed login count against the maximum allowed number of failures.

Prerequisites

  • You have obtained the ticket-granting ticket (TGT) of an administrative user in IdM.

Procedure

  1. Display the status of the user account to see the number of failed logins: 

    $ ipa user-status example_user
-----------------------
Account disabled: False
-----------------------
  Server: idm.example.com
  Failed logins: 8
  Last successful authentication: N/A
  Last failed authentication: 20220229080317Z
  Time now: 2022-02-29T08:04:46Z
----------------------------
Number of entries returned 1
----------------------------

  2. Display the number of allowed login attempts for a particular user: 

    $ ipa pwpolicy-show --user example_user
  Group: global_policy
  Max lifetime (days): 90
  Min lifetime (hours): 1
  History size: 0
  Character classes: 0
  Min length: 8
  Max failures: 6
  Failure reset interval: 60
  Lockout duration: 600
  Grace login limit: -1
  3. Compare the number of failed logins as displayed in the output of the ipa user-status command with the Max failures number displayed in the output of the ipa pwpolicy-show command. If the number of failed logins equals that of maximum allowed login attempts, the user account is locked.

Unlock a user account that was locked due to too many failed login attempts.

For security reasons, IdM does not display any warning message that the user account has been locked. Instead, the CLI prompt might continue asking the user for a password again and again.

IdM automatically unlocks the user account after a specified amount of time has passed. Alternatively, you can unlock the user account manually with the following procedure.

Prerequisites

  • You have obtained the ticket-granting ticket of an IdM administrative user.

Procedure

  • To unlock a user account, use the ipa user-unlock command. 

    $ ipa user-unlock idm_user
-----------------------
Unlocked account "idm_user"
-----------------------

    After this, the user can log in again.

Enable tracking of last successful Kerberos authentication timestamps for auditing purposes. This feature is disabled by default for performance reasons.

Prerequisites

  • You have obtained the ticket-granting ticket (TGT) of an administrative user in IdM.
  • You have root access to the IdM server on which you are executing the procedure.

Procedure

  1. Display the currently enabled password plug-in features: 

    # ipa config-show | grep "Password plugin features"
  Password plugin features: pass:quotes[AllowNThash], pass:quotes[KDC:Disable Last Success]

    The output shows that the KDC:Disable Last Success plug-in is enabled. The plug-in hides the last successful Kerberos authentication attempt from being visible in the ipa user-status output.

  2. Add the --ipaconfigstring=feature parameter for every feature to the ipa config-mod command that is currently enabled, except for KDC:Disable Last Success: 

    # ipa config-mod --ipaconfigstring='AllowNThash'

    This command enables only the AllowNThash plug-in. To enable multiple features, specify the --ipaconfigstring=feature parameter separately for each feature.

  3. Restart IdM: 

    # ipactl restart
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top