anonymous bind is required although $ldap_binddn is set

[averlon]

Hi,
I am trying to get the self-service-password running.

I have set the $ldap_binddn and $ldap_bindpw to allow a service account do the work.

Still $who_change_password = "user";

In my log I get:

Aug 10 06:04:37 v42252s8 slapd[134926]: conn=1046 op=0 RESULT tag=97 err=48 qtime=0.003096 etime=0.003413 text=anonymous bind disallowed

LDAP - Bind error 48  (Inappropriate authentication), referer:

I understood the settings in a way, that anonymous bind is not needed.

I would apreciate some hints where I could change something to make it work. At least, where to look at in more detail!
Thanks
Karl-Heinz

[davidcoutadeur]

Please don't open an issue if you have a question. There are mailing lists for that: https://ltb-project.org/contact.html

Also, if you need assistance, please share at least your configuration file, and the self-service-password logs.

Basically, there are 2 ways you can use self-service-password:

• you define an administrator, and give him rights for modifying any password
• or the final user modifies the password by himself (in that case, he should be allowed to modify his password too)

You must choose between there options and set up the LDAP parameters accordingly. See this reference: https://self-service-password.readthedocs.io/en/stable/config_ldap.html#credentials

[coudot]

Note that a new option has been created in SSP 1.8 when anonymous bind is wanted:

$ldap_build_user_dn = "$ldap_login_attribute={login},ou=users,$ldap_base";

But this option is not needed if you configured a service account

As requested by David, please provide some debug logs