Chapter 9. Configuring a system account in IdM to change user passwords without requiring a reset

Procedure

1. Obtain your privileged credentials:

   $ kinit admin

2. Create the system account using one of the following options:

   • To generate a random password to be used for LDAP authentication of the system account, use the --random option with the ipa sysaccount-add command:

     $ ipa sysaccount-add 'my-app' --random

   • To be prompted for the password of your choice, use the --password option with ipa sysaccount-add:

     $ ipa sysaccount-add 'my-app' --password

3. Create a privilege:

   $ ipa privilege-add 'my-app password change privilege'

4. Add the permission to change user passwords to the my-app password change privilege:

   $ ipa privilege-add-permission 'my-app password change privilege' --permission 'System: Change User password'

5. Create the my-app role:

   $ ipa role-add 'my-app role'

6. Add the my-app password change privilege privilege to the my-app role:

   $ ipa role-add-privilege 'my-app role' --privilege 'my-app password change privilege'

7. Add the my-app system account to the my-app role role as member:

   $ ipa role-add-member 'my-app role' --sysaccounts 'my-app'

8. Optional: To allow password changes without reset, enter:

   $ ipa sysaccount-policy 'my-app' --privileged=true

Verification

1. Using your external credential-management system, change an IdM user’s password.

2. Log in to IdM as the IdM user:

   $ kinit idmuser

3. When prompted, enter the new password:

   idmuser's password:

4. Verify that you have idmuser's Kerberos ticket-granting ticket:

   $ klist

   Credentials cache: API:0A481BBD-C3AA-473D-B43A-42CD19C7F045
           Principal: idmuser@IDM.EXAMPLE.COM
   
     Issued                Expires               Principal
   Feb 23 16:06:56 2026  Feb 24 02:04:54 2026  krbtgt/IDM.EXAMPLE.COM@IDM.EXAMPLE.COM

   The output confirms that you have a valid Kerberos ticket. You were able to log in without having to reset idmuser's password.