[QUOTE BY= gw1500se] Thanks for the reply. The ‘dscl’ command was the key. I wish I knew how to find commands when I don’t know what to look for. [/QUOTE]

Apple’s Server Admin Guides are very helpful. Surprisingly, the ACSA Skill Assessment Guides also have a lot of information as to which commands you should be aware of.

Here is an example

dscl -u directoryAdminsUsername -P dirAdminsPassword /LDAPv3/127.0.0.1 -passwd /Users/test thePasswordToBeSet

I create a user through LDAP without an authAuthority or password attribute then run the command above which fills in authAuthority and password attributes.

On 10.4 servers this creates an OpenDirectory password and on 10.3 creates a crypt password.

10.3 looks like
AuthenticationAuthority: ;basic;
Password: f/M20JHIh.gIM

10.4 looks like
AuthenticationAuthority: ;ApplePasswordServer;0x444525ea6ca0……
Password: ********

Both 10.3 and 10.4 servers create OpenDirectory passwords when creating new users in WorkGroup Manager.
I would like to know what I would have to do to make OpenDirectory /ApplePasswordServer passwords in 10.3 or have some control over the type of password created.

[quote]So: is it possible to issue an LDAP-modify command that succeeds in changing a user’s password on OpenDirectory?[/quote]

Try asking again. Normally, a user’s password is not stored in Open Directory (if it is stored, it would be stored in a crypted hash, readable by any user who wants to grab it for an offline attack).

A user’s password [actually various hashes of the password] is stored in the password server database, and in the kerberos principal database.

So, no, it’s not possible to use LDAP commands to modify pws and kdc info.