How can a user change their own password in openldap/slapd?

Question

linux

Good afternoon. There is an ldap domain example.org. It creates (via phpldapadmin/apache ds studio) new users. How to make the user password be able to set / change the initial password (as in MS AD) and how (maybe there is already a ready-made solution)?

Answer 1

The passwd option helps, but I had to edit /etc/pam.d/common-password:
it was:
became:
at the same time, I also had to fix slapd.conf:

# The admin dn has full write access, everyone else
# can read everything.
access to *
        by dn="@[email protected]" write
        by * read

on the:

# The admin dn has full write access, everyone else
# can read everything.
access to *
        by dn="@[email protected]" write
        by self write
        by * read

so that users can edit themselves.
I would like the user to be able to change the password himself without access to ssh.
ps found a solution to change the password in PHP , also see the comment from hellracer . Topic close

Answer 2

If accounts are logged in via shell, and ldap is bound via PAM, then it usually changes via passwd, the rest will be done by the system itself.
If accounts are somehow used differently, then it is possible through ldappasswd directly through ldap.