<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi to whom it may concern,<div class=""><br class=""></div><div class=""><br class=""></div><div class="">we used for many years a 2 location policy to separate email users from unix users in order to not using the same passwords. So we had 2 trees in our LDAP with the same user but different passwords. </div><div class=""><br class=""></div><div class="">In freeipa (where we want to migrate now) I can use the accounts and compat (for email) trees for this purpose and so I added a </div><div class=""><span style="widows: 1;" class=""><br class=""></span></div><div class=""><span style="widows: 1;" class="">dn: cn=users,cn=Schema Compatibility,cn=plugins,cn=config</span></div><div class=""><span style="widows: 1;" class="">changetype: modify</span></div><div class=""><span style="widows: 1;" class="">add: schema-compat-entry-attribute</span></div><div class=""><span style="widows: 1;" class="">schema-compat-entry-attribute: userPassword=*</span></div><div class=""><pre style="widows: 1;" class=""><span style="widows: auto;" class=""><font face="Helvetica" class=""><span style="white-space: normal;" class="">to the compat settings to have a separate place for the password (!not userPassword=%{userPassword}, because then the accounts password are mirrored). This works, but I’m not allowed to change the password i.e. with:</span></font></span></pre><pre style="widows: auto;" class=""><font face="Helvetica" class=""><span style="white-space: normal;" class=""> ldappasswd -x -D "cn=Directory Manager" -W -S uid=myuser,cn=users,cn=compat,dc=example,dc=com</span></font></pre><pre style="widows: auto;" class=""><font face="Helvetica" class=""><span style="white-space: normal;" class="">I get a result of:</span></font></pre><pre style="widows: auto;" class=""><span style="white-space: normal; font-family: Helvetica;" class=""><br class=""></span></pre><pre style="widows: auto;" class=""><span style="white-space: normal; font-family: Helvetica;" class="">No such object (32)</span></pre><pre style="widows: auto;" class=""><span style="font-family: Helvetica; white-space: normal;" class="">Additional info: Failed to update password</span></pre><pre class=""><font face="Helvetica" class=""><span style="white-space: normal;" class=""><br class=""></span></font></pre><pre class=""><font face="Helvetica" class=""><span style="white-space: normal;" class="">where as for the accounts tree the ldappasswd is working fine.</span></font></pre><pre class=""><font face="Helvetica" class=""><span style="white-space: normal;" class="">What additional setting may be required?</span></font></pre><pre class=""><font face="Helvetica" class=""><span style="white-space: normal;" class=""><br class=""></span></font></pre><pre class=""><font face="Helvetica" class=""><span style="white-space: normal;" class="">Regards,</span></font></pre><pre class=""><span style="white-space: normal; font-family: Helvetica;" class="">Rudi Gabler</span></pre><div class=""><br class=""></div><pre style="widows: auto;" class=""><font face="Helvetica" class=""><span style="white-space: normal;" class=""><br class=""></span></font></pre></div></body></html>