Allow password change

[b1rger]

hi,
when i try to use the passwd functionality of ldap, it seems that the default config forbids write access on the userPassword attribute.
With this test script:

import volatildap
import ldap
from django.test import TestCase
from django.utils.crypto import get_random_string

TEST_PASSWORD = 'Passwort123'
TEST_PASSWORD_HASH = '{SSHA}1wZn/TBKLhmQivSjixQi4gdNzFaXrSmp'

people = ('ou=people,dc=example,dc=org', {
    'objectClass': ['top', 'organizationalUnit'],
    'ou': ['people']
    })
wizuser = ('uid=wizuser,ou=people,dc=example,dc=org', {
    'objectClass': ['shadowAccount', 'inetOrgPerson'],
    'uid': ['wizuser-guest'],
    'userPassword': [TEST_PASSWORD_HASH.encode('ascii')],
    'cn': [b'Wiz'],
    'sn': [b'User'],
    'mail': [b'wizuser@example.org']
    })

directory = dict([people, wizuser])

class BaseTestCase(TestCase):
    directory = {}

    @classmethod
    def setUpClass(cls):
        super(BaseTestCase, cls).setUpClass()
        cls.ldap_server = volatildap.LdapServer(
            initial_data=cls.directory,
            schemas=['core.schema', 'cosine.schema', 'inetorgperson.schema', 'nis.schema'],
        )

    @classmethod
    def tearDownClass(cls):
        cls.ldap_server.stop()
        super(BaseTestCase, cls).tearDownClass()

    def setUp(self):
        super(BaseTestCase, self).setUp()
        self.ldap_server.start()

class ConnectionTestCase(BaseTestCase):
    directory = directory

    def test_ldap_passwd(self):
        l = ldap.initialize(self.ldap_server.uri)
        try:
            l.simple_bind_s("uid=wizuser,ou=people,dc=example,dc=org", TEST_PASSWORD)
            l.passwd_s("uid=wizuser,ou=people,dc=example,dc=org", TEST_PASSWORD, get_random_string(32))
            ret = True
        except ldap.LDAPError as e:
            print(e)
            ret = False
        self.assertTrue(ret)

i always get {'desc': 'Insufficient access'} - i tried to add the needed cn=config attributes, but i'm not sure about the syntax. It would be great if volatildap could allow access to the attribute by default or add an option to allow it.

thanks!