Hi,
I assume your question is about privileges 'Directory manager' vs
'Password Administrators'.
They are both allowed to bypass the password policy (global or local)
and set any value they want. While 'Directory manager' does not need
specific ACI, Administrators belonging to 'passwordAdminDN' group do
need ACIs granting read/write on password attributes [1]
[1] https://www.port389.org/docs/389ds/design/password-administrator.html
best regards
thierry
On 3/16/24 00:04, tdarby@xxxxxxxxxxx wrote:
I see tn the docs that you can make a Password Administrators group, like so:
dn: cn=config
changetype: modify
replace: passwordAdminDN
passwordAdminDN: cn=Passwd Admins,ou=groups,dc=example,dc=com
I'm curious though, what privileges does a Directory Administrator have over and above one of these Password Administrators.
--
_______________________________________________
389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
--
_______________________________________________
389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
