20.3. Changing Passwords Stored Externally

While most passwords can be changed through ldapmodify operations, there are some passwords that cannot be changed through regular LDAP operations. These passwords may be stored outside the Directory Server, such as passwords stored in a SASL application. These passwords can be modified through the password change extended operation.

Directory Server supports the password change extended operation as defined in RFC 3062, so users can change their passwords, using a suitable client, in a standards-compliant way. The dsidm utility passes the changes for the password for the specified user:

# dsidm ldap://server.example.com -D bind_dn -W -b dc=example,dc=com account change_password user newPassword oldPassword

For further details about the parameters, see the output of the dsidm instance_name account change_password --help command.

To use STARTTLS, which runs the command on a non-secure port, run dsidm with the -Z option and the standard LDAP port number. The password extended change operation has the following format:

Use the -Z option to force the connection to be successful.

To modify an entry's password, run dsidm like any other operation. It is necessary to specify a bind DN, even if the account is the same as that given in the bind DN. For example:

# dsidm ldap://server.example.com -Z bind_dn -W -b dc=example,dc=com account change_password user newPassword oldPassword

Access control is enforced for the password change operation. If the bind DN does not have rights to change the specified password, the operation will fail with an Insufficient rights error.