search

Zepmann / lldap-cli

A command line tool for managing LLDAP.
GNU General Public License v3.0
37 stars 7 forks source link

Unable to change the password of an user #5

Closed ldidry closed 9 months ago

ldidry commented 9 months ago

When trying to change the password of a user with the following command:

lldap-cli user update set foobar password bazqux

I get the following error:

/usr/sbin/lldap-cli: ligne 790: lldap_set_password : commande introuvable
Zepmann commented 9 months ago

As README.md states:

Furthermore, lldap_set_password is neccessary to set user passwords.

The password cannot be changed using the GraphQL API. lldap_set_password is a separate executable from the LLDAP project to build and install for this specific purpose.

It is also possible to change the password using an LDAP client (such as ldappasswd from OpenLDAP), but I removed support for this from an earlier version since it just adds more complexity without having any real benefit. It also subverts one of the security design ideas of LLDAP.

I could in theory use any (non-GraphQL) web API calls to change the password or maybe inject it into the web form, but LLDAP relies on client-side hashing of the new password if passwords are changed through the web interface. LLDAP-CLI would need to rely on some other tools (which include Argon2 support) to do this. Again, much more complex than relying on an executable that should be included with LLDAP anyway.

ldidry commented 9 months ago

Furthermore, lldap_set_password is neccessary to set user passwords.

Damn! Sorry about the issue.

Zepmann commented 8 months ago

No problem. :+1: , @ldidry!