LDAP password change should rebind as user

[politas]

How to support this request?

• Please use the 👍 reaction to show that you are also in favor of this feature - we are using this information to decide which features to include in upcoming Nextcloud versions.
• Please don't comment if you have no relevant information to add

---

Password changing for LDAP authenticated users require server settings to have write capable user
Usual LDAP system authentication systems only require a read-only user to search for user accounts. Putting a read-only account in the system LDAP settings does not allow users to change their LDAP passwords. The server tries to use the read-only account to change LDAP, which fails, even when the LDAP olcAccess is set to allow users to change their own password as is usually described as a requirement for LDAP password changes to be permitted.

Describe the solution you'd like
For password changes, NextCloud should rebind using the user's authentication in order to write the changes, allowing limited access to be given to the NextCloud server.

[politas]

I'll point out that doing password changes using an admin account is contrary to, and overrides, the LDAP olcAccess standard for allowing own password changes. NextCloud should not give users more access to a connected LDAP system than that system is configured to give.

[Caligatio]

I just switched my Nextcloud server over to using LDAP and this issue probably cost me about 90 minutes of troubleshooting to figure out. My LDAP server allows for anonymous authentication so I have not needed to give any applications accounts thus far.

Rebinding as the user that wants to change their password would be ideal.

[szaimen]

cc @nextcloud/ldap is this feasible?

This issue has been automatically marked as stale because it has not had recent activity and seems to be missing some essential information. It will be closed if no further activity occurs. Thank you for your contributions.

[politas]

Any pointers as to what the "missing info" might be?

This issue has been automatically marked as stale because it has not had recent activity and seems to be missing some essential information. It will be closed if no further activity occurs. Thank you for your contributions.

[Caligatio]

Bumping this as it's not stale.

This issue has been automatically marked as stale because it has not had recent activity and seems to be missing some essential information. It will be closed if no further activity occurs. Thank you for your contributions.