[Fedora-directory-users] DSGW problem - browser user tries to change password

[John A. Sullivan III]

On Tue, 2008-12-02 at 08:37 -0700, Rich Megginson wrote:
> John A. Sullivan III wrote:
> > Hello, all.  As explained in the last email, we do not allow anonymous
> > browsing but have a specific user with limited rights browsing the tree
> > to find users' identities for logging into DSGW.  We also have a policy
> > that users must change their passwords after a reset.
> >
> > We have a test user sue.sutter.  We reset her password and then had her
> > attempt to login to DSGW.  Sure enough, she was told she needed to
> > changed her password and was given the option to do so.  However, the
> > attempt failed with the below error messages:
> >
> > Editing sue.sutter... 
> > Sending changes to the directory server...
> >
> > An error occurred while contacting the LDAP server. 
> > (Insufficient access - Insufficient 'write' privilege to the
> > 'userPassword' attribute of entry
> > 'uid=sue.sutter,ou=users,o=a0000-0006,o=internal,dc=ssiservices,dc=biz'. )
> > You do not have sufficient privileges to perform the operation. 
> >
> > That seemed very strange because when we test changing passwords using
> > her posix account, it works just fine.  We then gave the browsing user
> > (not sue.sutter) full rights to the tree and, lo and behold, it worked:
> >
> > Giving the directory browser user all rights allowed a successful
> > password change.
> >
> > It appears the browsing user is the one attempting to change the user's
> > password and not the user.  Is that the way it's supposed to be? I
> > certainly would not want a browse only utility user able to change user
> > passwords.  Perhaps I am missing something.  Thanks - John
> >   
> I suppose it is because you have configured the DSGW to use the browsing 
> user.  I'm not sure how to change the DSGW to use the browsing user for 
> some operations but not others, or even if it is possible.
<snip>
I might be out of place to say this but I suspect it is a design flaw.
Even if we allowed anonymous browsing, the last thing on Earth we want
is for an anonymously browsing user to change passwords.  I would think
the code is not setting the user for the change password operation to
the logged in user but rather whoever browsed which could be
"ldap:///anyone".  Thanks - John
-- 
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan at opensourcedevel.com

http://www.spiritualoutreach.com
Making Christianity intelligible to secular society