Passwords
Note
Examples in this documentation depend on features activated in the ds-evaluation setup profile.
For details, see "Learn About the Evaluation Setup Profile".
The ldappasswordmodify command lets authorized users change their own passwords and reset other users' passwords.
Whenever one user changes another user's password, DS servers consider it a password reset. Often password policies specify that users must change their passwords again after a password reset.
Assume password administrator Kirsten Vaughan has the password-reset privilege. The following example shows Kirsten resetting Andy Hall's password:
$ldappasswordmodify \ --hostname localhost \ --port 1636 \ --useSsl \ --usePkcs12TrustStore /path/to/opendj/config/keystore \ --trustStorePasswordFile /path/to/opendj/config/keystore.pin \ --bindDN "uid=kvaughan,ou=people,dc=example,dc=com" \ --bindPassword bribery \ --authzID "dn:uid=ahall,ou=people,dc=example,dc=com"The LDAP password modify operation was successful Generated Password: <password>
If a client application performs the LDAP password modify extended operation on a connection that is bound to a user (in other words, when a user first does a bind on the connection, then requests the LDAP Password Modify extended operation), then the operation is performed as the user associated with the connection. If the user associated with the connection is not the same user whose password is being changed, then DS servers consider it a password reset.
To change, rather than reset, the password as the user while binding as an application or an administrator, use the LDAP Password Modify extended operation with an authorization ID. Alternatively, use proxied authorization, as described in Proxied Authorization.
If you reset a password, and do not want it to count as a password reset, use the manage-account command with the set-password-is-reset hidden option, supported only for testing:
$ manage-account \
set-password-is-reset \
--hostname localhost \
--port 4444 \
--bindDN uid=admin \
--bindPassword password \
--targetDN uid=ahall,ou=people,dc=example,dc=com \
--operationValue true \
--usePkcs12TrustStore /path/to/opendj/config/keystore \
--trustStorePasswordFile /path/to/opendj/config/keystore.pinUsers can change their own passwords with the ldappasswordmodify command as long as they know their current password:
$ ldappasswordmodify \
--hostname localhost \
--port 1636 \
--useSsl \
--usePkcs12TrustStore /path/to/opendj/config/keystore \
--trustStorePasswordFile /path/to/opendj/config/keystore.pin \
--bindDN "uid=ahunter,ou=people,dc=example,dc=com" \
--bindPassword egregious \
--newPassword chngthspwd The same operation works for directory superusers, such as uid=admin:
$ ldappasswordmodify \
--hostname localhost \
--port 1636 \
--useSsl \
--usePkcs12TrustStore /path/to/opendj/config/keystore \
--trustStorePasswordFile /path/to/opendj/config/keystore.pin \
--authzID dn:uid=admin \
--currentPassword password \
--newPassword OzNOkkfkTJDSW9BgThe ldappasswordmodify and ldapmodify commands support password quality advice controls to get additional information about why a password update failed. When you use the request control and a password update fails, the server can send the response control with details indicating which validators rejected the new password.
Note
The new LDAP control has interface stability: Evolving.
The following commands demonstrate how the tools show the information from the response control:
$ldapmodify \ --hostname localhost \ --port 1636 \ --useSsl \ --usePkcs12TrustStore /path/to/opendj/config/keystore \ --trustStorePasswordFile /path/to/opendj/config/keystore.pin \ --bindDN uid=admin \ --bindPassword password << EOF dn: dc=example,dc=com changetype: modify add: aci aci: (targetcontrol="PasswordQualityAdvice") (version 3.0; acl "Authenticated users can check password quality"; allow(read) userdn="ldap:///all";) EOF$ldapmodify \ --hostname localhost \ --port 1636 \ --useSsl \ --usePkcs12TrustStore /path/to/opendj/config/keystore \ --trustStorePasswordFile /path/to/opendj/config/keystore.pin \ --bindDN uid=admin \ --bindPassword password << EOF dn: cn=Minimum length policy,dc=example,dc=com objectClass: top objectClass: subentry objectClass: ds-pwp-password-policy objectClass: ds-pwp-validator objectClass: ds-pwp-length-based-validator cn: Minimum length policy ds-pwp-password-attribute: userPassword ds-pwp-default-password-storage-scheme: PBKDF2-HMAC-SHA512 ds-pwp-length-based-min-password-length: 8 subtreeSpecification: {base "ou=people", specificationFilter "(uid=pshelton)" } EOF$ldappasswordmodify \ --hostname localhost \ --port 1636 \ --useSsl \ --usePkcs12TrustStore /path/to/opendj/config/keystore \ --trustStorePasswordFile /path/to/opendj/config/keystore.pin \ --bindDN uid=pshelton,ou=People,dc=example,dc=com \ --bindPassword nosedive \ --control PasswordQualityAdvice:true \ --control NoOp \ --newPassword passwdThe LDAP password modify operation failed: 19 (Constraint Violation) Additional Information: The provided new password failed the validation checks defined in the server: The provided password is shorter than the minimum required length of 8 characters The new password was rejected by the password policy located in "cn=Minimum length policy,dc=example,dc=com" The following password quality criteria were not satisfied: * length-based with parameters {max-password-length=0, min-password-length=8}
Notice that the check can be performed as a no-op.
DS servers expect passwords to be UTF-8 encoded and base64-encoded when included in LDIF. UTF-8 characters such as à or ô must be correctly encoded:
$export LANG=en_US.UTF-8$ldappasswordmodify \ --hostname localhost \ --port 1636 \ --useSsl \ --usePkcs12TrustStore /path/to/opendj/config/keystore \ --trustStorePasswordFile /path/to/opendj/config/keystore.pin \ --bindDN uid=wlutz,ou=People,dc=example,dc=com \ --bindPassword bassinet \ --newPassword pàsswȏrd$ldapsearch \ --hostname localhost \ --port 1636 \ --useSsl \ --usePkcs12TrustStore /path/to/opendj/config/keystore \ --trustStorePasswordFile /path/to/opendj/config/keystore.pin \ --bindDN uid=wlutz,ou=People,dc=example,dc=com \ --bindPassword pàsswȏrd \ --baseDN dc=example,dc=com \ "(uid=wlutz)" \ 1.1dn: uid=wlutz,ou=People,dc=example,dc=com