Troubleshooting: Password Reset Is Not Supported with an OpenLDAP Datastore

Version Affected: All
 
 

Overview

SecureAuth's Password Reset feature is not currently supported with an OpenLDAP datastore.

Cause

Password Reset does not have native support for writing a new password back to OpenLDAP.

Resolution

As a workaround, you can update the password through a Self-Service Account Update realm instead. With this method, the password update is sent in clear text, so treat the workaround's security tradeoff accordingly.

1. Set up a Self-Service Account Update realm.
2. Configure the Self-Service Account page and set Aux ID 1 to show, enabled.
3. On the realm's Data tab, set the Data Store to SUN ONE. Under Profile Fields, enter userPassword for the Aux ID 1 field and enable Writable.

Special Considerations

When a plain-text password is stored in the userPassword attribute using add/modify LDAP operations, OpenLDAP stores it as plain text by default. You can override this using the ppolicy_hash_cleartext option in OpenLDAP's ppolicy overlay module — once enabled, a plain-text password sent by a client is stored as SSHA instead.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.