主页
产品
Red Hat Enterprise Linux
10
Managing IdM users, groups, hosts, and access control rules
5.7. Enabling password reset in IdM without prompting the user for a password change at the next login

5.7. Enabling password reset in IdM without prompting the user for a password change at the next login

By default, when an administrator resets another user’s password, the password expires after the first successful login.

As IdM Directory Manager, you can specify the following privileges for individual IdM administrators:

They can perform password change operations without requiring users to change their passwords subsequently on their first login.
They can bypass the password policy so that no strength or history enforcement is applied.

警告

Bypassing the password policy can be a security threat. Exercise caution when selecting users to whom you grant these additional privileges.

Prerequisites

Procedure

Enter the ldapmodify command to modify LDAP entries. Specify the name of the IdM server and the 389 port and press Enter:
```
$ ldapmodify -x -D "cn=Directory Manager" -W -h server.idm.example.com -p 389
Enter LDAP Password: <password>
```
Enter the Directory Manager password.
Enter the distinguished name for the ipa_pwd_extop password synchronization entry and press Enter:
```
dn: cn=ipa_pwd_extop,cn=plugins,cn=config
```
Specify the modify type of change and press Enter:
```
changetype: modify
```
Specify what type of modification you want LDAP to execute and to which attribute. Press Enter:
```
add: passSyncManagersDNs
```
Specify the administrative user accounts in the passSyncManagersDNs attribute. The attribute is multi-valued. For example, to grant the admin user the password resetting powers of Directory Manager:
```
passSyncManagersDNs: \
uid=admin,cn=users,cn=accounts,dc=example,dc=com
```
Press Enter twice to stop editing the entry.
The admin user, listed under passSyncManagerDNs, now has the additional privileges. Repeat the steps on every Identity Management (IdM) server in the domain.