ldapv3.pdf 7947KB Apr 17 2013 11:30:42 AM - mirror omadata

The shadowLastChange Bug
If a user's object has an objectclass of shadowAccount, upon changing or
setting the password, pam_ldap.so will attempt to update the shadow
attribute shadowLastChange.
The userpasswd attribute is modified via a binding either the DN defined
in /etc/ldap.conf (passwd command executed as the superuser) or as the
user's dn (passwd command executed by the user).
The shadowLastChange attribute should be modified in the context of the
same binding, however, prior to version XXX of pam_ldap.so the PAM
module would rebind annonymously in order to modify
shadowLastChange. This caused the updating of shadowLastChange to
fail unless anonymous binds were permitted write authortity on the
attribute (a bad idea).
A user does require the ability to modify their own shadowLastChange
attribute in order to provide shadow functionality via pam_ldap.so.