UCS 2.4 - Univention

7 UCS Directory service
7.4.6 Delegation of the privilege to reset user passwords
To facilitate the delegation of the privilege to reset user passwords, the univention-admingrp-user-
passwordreset package can be installed. It uses a join script to create the User Password Admins
user group, in so far as this does not already exist.
Members of this group receive the permission via additional LDAP ACLs to reset the passwords
of other users. These LDAP ACLs are activated automatically during the package installation. To
use another group, or a group that already exists, instead of the User Password Admins group,
the DN of the group to be used can be entered in the Univention Configuration Registry variable
ldap/acl/user/passwordreset/accesslist/groups/dn.
Passwords can be reset via Univention Directory Manager. In the default setting, Univention Directory
Manager only offers the user wizard to the Administrator user, which allows the setting of new passwords.
During the installation a new default-user-password-admins policy is created automatically, which can
be linked to the members of the User Password Admins group and/or a corresponding container in the
LDAP directory.
The policy makes it possible to search for users and create an overview of all the attributes of a user object.
If an attempt is made to modify further attributes in addition to the password when the user does not have
sufficient access rights to the LDAP directory, Univention Directory Manager denies him write access with
the message Permission denied.
Attention:
The package should be installed on the domain controller master and the domain controller backup sys-
tems. During the installation, the LDAP server is restarted and is thus temporarily unavailable.
To prevent the resetting of the passwords for certain users (e.g., domain administrators), the UIDs of the
users to be protected can be entered, separated by commas, in the Univention Configuration Registry
variable ldap/acl/user/passwordreset/protected/uid. Once a variable has been changed, it is
necessary to restart the LDAP directoy service using the /etc/init.d/slapd restart command for
the changed LDAP ACLs to take effect. In the default setting, the Administrator user is protected against
having his password changed by the User Password Admins group.
If access to additional LDAP attributes should be necessary for changing the pass-
word, the attribute names can be expanded in Univention Configuration Registry variable
ldap/acl/user/passwordreset/attributes. After the change, the LDAP directory service
must be restarted for the change to take effect. This variable is already set appropriately for a UCS
standard installation.
186