20.7. Managing the Directory Manager Password

The Directory Manager is the privileged database administrator, comparable to the root user in Linux. The Directory Manager entry and the corresponding password are set during the instance installation.
The default distinguished name (DN) of the Directory Manager is cn=Directory Manager.

20.7.1. Resetting the Directory Manager Password

If you lose the Directory Manager password, reset it:
  1. Stop the Directory Server instance: 
    # dsctl instance_name stop
  2. Generate a new password hash. For example: 
    # pwdhash -D /etc/dirsrv/slapd-instance_name password
{PBKDF2_SHA256}AAAgABU0bKhyjY53NcxY33ueoPjOUWtl4iyYN5uW...
    Specifying the path to the Directory Server configuration automatically uses the password storage scheme set in the nsslapd-rootpwstoragescheme attribute to encrypt the new password.
  3. Edit the /etc/dirsrv/slapd-instance_name/dse.ldif file and set the nsslapd-rootpw attribute to the value displayed in the previous step: 
    nsslapd-rootpw: {PBKDF2_SHA256}AAAgABU0bKhyjY53NcxY33ueoPjOUWtl4iyYN5uW...
  4. Start the Directory Server instance: 
    # dsctl instance_name start

20.7.2. Changing the Directory Manager Password

This section describes how to can change the password of the Directory Manager account.

20.7.2.1. Changing the Directory Manager Password Using the Command Line

Use one of the following options to set the new password:

Important

Only set the password using an encrypted connection. Using an unencrypted connection can expose the password to the network. If your server does not support encrypted connections, use the web console to update the Directory Manager password. See Section 20.7.2.2, “Changing the Directory Manager Password Using the Web Console”.
  • To set the nsslapd-rootpw parameter to a plain text value which Directory Server automatically encrypts: 
    # dsconf -D "cn=Directory Manager" ldaps://server.example.com config replace nsslapd-rootpw=password

    Warning

    Do not use curly braces ({}) in the password. Directory Server stores the password in the {password-storage-scheme}hashed_password format. The server interprets characters in curly braces as the password storage scheme. If the string is an invalid storage scheme or if the password is not correctly hashed, the Directory Manager cannot connect to the server.
  • To manually encrypt the password and setting it in the nsslapd-rootpw parameter:
    1. Generate a new password hash. For example: 
      # pwdhash -D /etc/dirsrv/slapd-instance_name password
{PBKDF2_SHA256}AAAgAMwPYIhEkQozTagoX6RGG5E7d6/6oOJ8TVty...
      Specifying the path to the Directory Server configuration automatically uses the password storage scheme set in the nsslapd-rootpwstoragescheme attribute to encrypt the new password.
    2. Set the nsslapd-rootpw attribute to the value displayed in the previous step using a secure connection (STARTTLS): 
      # dsconf -D "cn=Directory Manager" ldaps://server.example.com config replace nsslapd-rootpw="{PBKDF2_SHA256}AAAgAMwPYIhEkQozTagoX6RGG5E7d6/6oOJ8TVty..."

20.7.2.2. Changing the Directory Manager Password Using the Web Console

As the administrator, perform these steps to change the password:
  1. Open the Directory Server user interface in the web console. See Section 1.4, “Logging Into Directory Server Using the Web Console”.
  2. Select the instance.
  3. Open the Server Settings menu, and select Server Settings.
  4. Open the Directory Manager tab.
  5. Enter the new password into the Directory Manager Password and Confirm Password fields
  6. Optionally, set a different password storage scheme.
  7. Click Save.

20.7.3. Changing the Directory Manager Password Storage Scheme

The password storage scheme specifies which algorithm Directory Server uses to hash a password. To change the storage scheme using the command line, your server must support encrypted connections. If your server does not support encrypted connections, use the web console to set the storage scheme. See Section 20.7.3.2, “Changing the Directory Manager Password Storage Scheme Using the Web Console”.
Note that the storage scheme of the Directory Manager (nsslapd-rootpwstoragescheme) can be different than the scheme used to encrypt user passwords (nsslapd-pwstoragescheme).
For a list of supported password storage schemes, see the corresponding section in the Red Hat Directory Server Configuration, Command, and File Reference.

Note

If you change the Directory Manager's password storage scheme you must also reset its password. Existing passwords cannot be re-encrypted.

20.7.3.1. Changing the Directory Manager Password Storage Scheme Using the Command Line

If your server supports encrypted connections, perform these steps to change the password storage scheme:
  1. Generate a new password hash that uses the new storage scheme. For example: 
    # pwdhash -s PBKDF2_SHA256 password
{PBKDF2_SHA256}AAAgAMwPYIhEkQozTagoX6RGG5E7d6/6oOJ8TVty...
  2. Set the nsslapd-rootpwstoragescheme attribute to the storage scheme and the nsslapd-rootpw attribute to the value displayed in the previous step using a secure connection (STARTTLS): 
    # dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-rootpwstoragescheme=PBKDF2_SHA256 nsslapd-rootpw="{PBKDF2_SHA256}AAAgAMwPYIhEkQozTagoX6RGG5E7d6/6oOJ8TVty..."

20.7.3.2. Changing the Directory Manager Password Storage Scheme Using the Web Console

Perform these steps to change the password using the web console:
  1. Open the Directory Server user interface in the web console. See Section 1.4, “Logging Into Directory Server Using the Web Console”.
  2. Select the instance.
  3. Open the Server Settings menu, and select Server Settings.
  4. Open the Directory Manager tab.
  5. Set the password storage scheme.
  6. Directory Server cannot re-encrypt the current password using the new storage scheme. Therefore, enter a new password into the Directory Manager Password and Confirm Password field.
  7. Click Save Configuration.

20.7.4. Changing the Directory Manager DN

As the administrator, perform the following step to change the Directory Manager DN to cn=New Directory Manager: 
# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-rootdn="cn=New Directory Manager"
Note that Directory Server supports only changing the Directory Manager DNs using the command line.