Change mail and phone number in LDAP directory does not works

[ewok2]

Hello
I just install this pasword service and it is wonderfull!!! many thanks for the dev.
Password reset by mail or password change on the web site works fine
My only concern is for the email change...

In the config.inc.local.php I set

$use_attributes = true;
$attribute_mail = "mail";

But no change on the web page, no option to change the mail.

On the doc it was writen :

When enabling this feature, a note will be added in help messages to advertise users they can change their mail or their phone. You can also access directly to the page with ?action=setattributes.

and

If attribute is not defined, the mail is not displayed in set attributes page.

If I perform the folowing request to my openldap :
sudo ldapsearch -Y EXTERNAL -b "dc=domain,dc=com" -H ldapi:/// "(uid=user)"
I get an answer with the field "mail" with the right value

If I try to access the "main page" with ?action=setattributes added nothing change...

Any idea of the problem?

[coudot]

This is a feature of 1.6 version which should be released in a few days

You can get the code from the git if you want to test it

[ewok2]

Thanks for reply
The documentation is ready befor the code ;-) that in IT not so often :-)
I install the "self-service-password" with apt...
I will continue the configuration befor play with compilation of source.

I would like to change nginx -> openresty to be able to put this server behind my oauth (to get 2 factor)
My only concern is if someone loose his password he will not be able to reset his password without the help of another user :-)

[coudot]

As you might have seen, version1.6 was released last week.

[ewok2]

Thanks didn't see it.
I have install it but it seem's I have to change my conf somewhere.
I get this Error when trying to change the mail (the password change works)

[error] FastCGI sent in stderr: "PHP message: Module Zxcvbn successfully loadedPHP message: PHP Warning: Undefined variable $attribute_phone in /usr/share/self-service-password/htdocs/setattributes.php on line 113PHP message: PHP Warning: ldap_mod_replace(): Modify: Insufficient access in /usr/share/self-service-password/htdocs/setattributes.php on line 117PHP message: LDAP - Modify attributes (error 50 (Insufficient access)PHP message: PHP Warning: Undefined variable $audit_log_file in /usr/share/self-service-password/htdocs/index.php on line 200" while reading response header from upstream, client: 192.168.yyy.xxx, server: selfchange.mydomain.com, request: "POST /index.php?action=setattributes HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.1-fpm.sock:", host: "selfchange.mydomain.com", referrer: "https://selfchange.mydomain.com/index.php?action=setattributes"

I can see "Insufficient access in /usr/share/self-service-password/htdocs/setattributes.php"
Does it mean htdocs directory should be to www-data user instead of root?
Or is it more a ldap access that not allow the changes ?

[davidcoutadeur]

The message LDAP - Modify attributes (error 50 (Insufficient access) indicate a problem of rights on the LDAP directory. You should give enough rights to the account doing the modification.

[ewok2]

That is strange, because I use the admin account of the LDAP to connect to the ldap.
With this account under Ldap Acount Manager I can reset any mail / password of any count?

I think I may have understand
The log message is the concatenation of many message strating with [error] but with warning also inside :-)

So my initial message can bez split ?

[error] FastCGI sent in stderr: "PHP message: Module Zxcvbn successfully loadedPHP message:
=> Always present when there is a error/warning ?

PHP Warning: Undefined variable $attribute_phone in /usr/share/self-service-password/htdocs/setattributes.php on line 113
=> Ok only a warning that can be removed with the ldap name of the phone number in config.inc.local.php ?

PHP message: PHP Warning: ldap_mod_replace(): Modify: Insufficient access in /usr/share/self-service-password/htdocs/setattributes.php on line 117PHP message: LDAP - Modify attributes (error 50 (Insufficient access)
=> The error that does not allow to change the mail in the LDAP

PHP message: PHP Warning: Undefined variable $audit_log_file in /usr/share/self-service-password/htdocs/index.php on line 200"
=> I have removed it by adding a log file path in config.inc.local.php

while reading response header from upstream, client: 192.168.yyy.xxx, server: selfchange.mydomain.com, request: "POST /index.php?action=setattributes HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.1-fpm.sock:", host: "selfchange.mydomain.com", referrer: "https://selfchange.mydomain.com/index.php?action=setattributes"
=> The end of the message always present also ?

[ewok2]

a strange thing " Undefined variable $attribute_phone"
I did not activate the modification with SMS...
So he should not need it ?

[davidcoutadeur]

Indeed, but in this case, this is just a warning.