Privileges - restrict "changepassword"

Sure it is possible.

Depending on what access controls are set in your server you can:

- make sure that no aci grant write access to the password (userPassword attribute).

- create aci that deny write access to the password (although I would recommend the first solution. Deny aci are difficult to manage and explain as they are creating exceptions to the access granted. Also when removing a deny ACI, rights are not removed, the opposite rights are in fact granted, reducing the overall security.

Regardsm

Ludovic.

ludovicp at 2007-7-7 2:47:46 >