The mailing list for listmasters using Sympa

[<address@concealed>]

Hello,

We are running the latest Sympa Version (6.1.9) and have LDAP authentication
configured in auth.conf.

On the Sympa login page (without a user logged in), if an LDAP user clicks
"Lost Password" and enters their email address, then they correctly get the
error message: "Your password is stored in an LDAP directory, therefore Sympa
cannot post a reminder".

However, if the same user logs in (using either their LDAP CN or LDAP Email
address) and goes to "Your Preferences" then the options "Changing your email
address" and "Changing your password" are displayed.  If the user tries
setting a new password then the message "setpasswd: action completed is
displayed", i.e. the password change appears to succeed!  They then are able
to log in using their LDAP Email address with their NEW password, but their
LDAP CN only with their "real" (LDAP directory) password.

This looks like a bug - could someone please advise with LDAP users are
getting a "Changing your password" option ?

Thanks,

Patrick