https://github.com/lldap/lldap logo
Powered by
Hendrik - Hello, this is a question regarding t...
# troubleshooting
h
Hello, this is a question regarding the 
lldap_password_manager
group and authelia. Even after adding the authelia user to that group I still get an 
Insufficient Access Rights
error when resetting or changing the password. I have searched multiple discussion, but I haven't found this exact problem before. I have attached both the verbose LLDAP log and trace level authelia logs to cross reference the requests being made. Both logs are redacted using 
example.com
as the placeholder.
a
message has been deleted
h
Using the 
lldap_admin
group instead resolves the issue, however this is not the recommended way following the README, authelia setup guide and responses from nitnelave.
n
I'm guessing you're trying to change the password of an admin
You can't do that with just the password manager privilege, that would let you get a trivial privilege escalation
Channing the password of any other user is fine
h
Yes, the user is an 
lldap_admin
. That's understandable. Is there documentation regarding this which I missed?
n
I guess not. Where would you have expected it?
h
I think the general configuration guide in the readme. I just searched for the group name and couldn't find anything except that: https://github.com/lldap/lldap?tab=readme-ov-file#general-configuration-guide. The custom lldap groups are pretty self explanatory, but I think this case isn't really obvious to the user
Many thanks for the quick response 👍
n
That's a good place. Do you want to send a PR adding it?
h
Sure, would this addition be acceptable?
Copy code
md
To prevent privilege escalation users in the
`lldap_password_manager` group are not allowed to change passwords of admins in the
`lldap_admin` group.
n
Yeah, that sounds perfect
PreviousNext
Powered by