Self-service reset: Unable to find user account. about lam HOT 3 CLOSED

By default, LAM uses security questions for the reset procedure. They require a special LDAP schema:

https://www.ldap-account-manager.org/static/doc/manual/ape.html

Users that have no question will not be found.
If you do not want to use security questions then please activate the confirmation email and tick to do not ask the security question.

If this does not solve the issue please check LAM's log on level Debug:

https://www.ldap-account-manager.org/static/doc/manual/ch03.html#conf_logging

from lam.

The debug showed the problem:
Apr 10 09:06:24 dummy php[1000343]: LDAP Account Manager (1jmg3add1brptgnq7qqh8u2fvl - 10.237.12.36,10.237.12.28 - ) - NOTICE: Self service password reset: Unable to find user entry for [email protected] (multiple entries found).

Changing the duplicate record fixed the problem. Perhaps a more descriptive error message would be better.

FWIW: we prefer not to use the standard scheme of security questions as we don't want to extend the LDAP schema and our environment is isolated. The password reset via e-mail functionality suits best and now works fine.

from lam.

Thanks a lot for the update.
Unfortunately, the IT Security departments do not allow detailed messages for security reasons (user enumeration). This is why LAM prints a generic message and logs the details.

I will close this then as the problem is solved.

from lam.