From 3e504bcbbf99fe64d14a83f188f56ba44430667c Mon Sep 17 00:00:00 2001 From: Pierangelo Masarati Date: Sat, 20 Aug 2011 19:02:06 -0600 Subject: [PATCH] add notes about pwdAllowUserChange (more about ITS#7021) --- doc/man/man5/slapo-ppolicy.5 | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/doc/man/man5/slapo-ppolicy.5 b/doc/man/man5/slapo-ppolicy.5 index f3e0497713..c0bf32fe59 100644 --- a/doc/man/man5/slapo-ppolicy.5 +++ b/doc/man/man5/slapo-ppolicy.5 @@ -414,6 +414,23 @@ is set to "TRUE", or if the attribute is not present, users will be allowed to change their own passwords. If its value is "FALSE", users will not be allowed to change their own passwords. .LP +Note: this implies that when +.B pwdAllowUserChange +is set to "TRUE", +users will still be able to change the password of another user, +subjected to access control. +This restriction only applies to modifications of ones's own password. +It should also be noted that +.B pwdAllowUserChange +was defined in the specification to provide rough access control +to the password attribute in implementations that do not allow fine-grain +access control. +Since OpenLDAP provides fine-grain access control, the use of this attribute +is discouraged; ACLs should be used instead +(see +.BR slapd.access (5) +for details). +.LP .RS 4 ( 1.3.6.1.4.1.42.2.27.8.1.14 NAME 'pwdAllowUserChange' -- 2.47.2