<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 05/21/2015 02:59 AM, Rudolf Gabler
wrote:<br>
</div>
<blockquote
cite="mid:511ED412-6929-41C9-AB33-9344CC09AA76@usm.lmu.de"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
Hi to whom it may concern,
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">we used for many years a 2 location policy to
separate email users from unix users in order to not using the
same passwords. So we had 2 trees in our LDAP with the same user
but different passwords. <br>
</div>
</blockquote>
<br>
<br>
Sorry for reviving this thread a month later.<br>
<br>
I am a bit puzzled. On one hand I hear a lot of desire of the
consolidation on the single account and making sure the password the
user has is compliant with the central policies.<br>
On the other side I continue to come across the cases when single
account needs more than one password. And I am really confused why?<br>
Would using OTP for example be a good enough alternative? What is
the practical reason to force user to have more than one password in
the enterprise environment?<br>
<br>
I wonder does OTP auth with IPA native tokens work against compat
tree? It should...<br>
So with OTP it is always different password for two accounts. Should
be good enough. No?<br>
<br>
What am I missing?<br>
<br>
Dmitri<br>
<br>
<blockquote
cite="mid:511ED412-6929-41C9-AB33-9344CC09AA76@usm.lmu.de"
type="cite">
<div class=""><br class="">
</div>
<div class="">In freeipa (where we want to migrate now) I can use
the accounts and compat (for email) trees for this purpose and
so I added a </div>
<div class=""><span style="widows: 1;" class=""><br class="">
</span></div>
<div class=""><span style="widows: 1;" class="">dn:
cn=users,cn=Schema Compatibility,cn=plugins,cn=config</span></div>
<div class=""><span style="widows: 1;" class="">changetype: modify</span></div>
<div class=""><span style="widows: 1;" class="">add:
schema-compat-entry-attribute</span></div>
<div class=""><span style="widows: 1;" class="">schema-compat-entry-attribute:
userPassword=*</span></div>
<div class="">
<pre style="widows: 1;" class=""><span style="widows: auto;" class=""><font class="" face="Helvetica"><span style="white-space: normal;" class="">to the compat settings to have a separate place for the password (!not userPassword=%{userPassword}, because then the accounts password are mirrored). This works, but I’m not allowed to change the password i.e. with:</span></font></span></pre>
<pre style="widows: auto;" class=""><font class="" face="Helvetica"><span style="white-space: normal;" class=""> ldappasswd -x -D "cn=Directory Manager" -W -S uid=myuser,cn=users,cn=compat,dc=example,dc=com</span></font></pre>
<pre style="widows: auto;" class=""><font class="" face="Helvetica"><span style="white-space: normal;" class="">I get a result of:</span></font></pre>
<pre style="widows: auto;" class=""><span style="white-space: normal; font-family: Helvetica;" class="">
</span></pre>
<pre style="widows: auto;" class=""><span style="white-space: normal; font-family: Helvetica;" class="">No such object (32)</span></pre>
<pre style="widows: auto;" class=""><span style="font-family: Helvetica; white-space: normal;" class="">Additional info: Failed to update password</span></pre>
<pre class=""><font class="" face="Helvetica"><span style="white-space: normal;" class="">
</span></font></pre>
<pre class=""><font class="" face="Helvetica"><span style="white-space: normal;" class="">where as for the accounts tree the ldappasswd is working fine.</span></font></pre>
<pre class=""><font class="" face="Helvetica"><span style="white-space: normal;" class="">What additional setting may be required?</span></font></pre>
<pre class=""><font class="" face="Helvetica"><span style="white-space: normal;" class="">
</span></font></pre>
<pre class=""><font class="" face="Helvetica"><span style="white-space: normal;" class="">Regards,</span></font></pre>
<pre class=""><span style="white-space: normal; font-family: Helvetica;" class="">Rudi Gabler</span></pre>
<div class=""><br class="">
</div>
<pre style="widows: auto;" class=""><font class="" face="Helvetica"><span style="white-space: normal;" class="">
</span></font></pre>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Director of Engineering for IdM portfolio
Red Hat, Inc.</pre>
</body>
</html>