[389-users] "Directory Manager" can't change user's password; result is an inaccessible account.

[Janet Houser]

Hi folks,

I'm fairly new to 389-ds and I ran into an issue when trying to update a 
user's password via the command line.

I was able to change a password "as" the user via the command line using 
the following syntax without issue:

ldappasswd -h my389dsserver.domain.edu -p 389 -ZZ -D 
"uid=jdoe,ou=People,dc=domain,dc=edu" -w current_user_passwd -s 
new_user_passwd "uid=jdoe,ou=People,dc=domain,dc=edu"

However, when I tried doing the same thing as the Directory Manager, it 
changes the password hash, but it doesn't update the password. In fact, 
after
issuing the following command (see below), both the old and new 
passwords don't work:


ldappasswd -h my389dsserver.domain.edu -p 389 -ZZ -D "cn=Directory 
Manager" -w directorymanager_passwd -s new_user_passwd 
"uid=jdoe,ou=People,dc=int,dc=boulder,dc=nso,dc=edu"


I found the following page, 
http://directory.fedoraproject.org/docs/389ds/design/password-administrat..., 
but being fairly
new to 389-ds I wasn't sure how to create/define/add the ability to be a 
password administrator to an account.

Any suggestions would be appreciated.

Thanks,

/jh