Hi,

I have the following issue.

1) I have created a new user in AD. 2) When forcing user to change password at next logon in AD, password change does not work from the Linux client.

But, if I don't force the user to change password at next logon in AD, then after logging in, I can change password of the user with passwd command.

Is this normal? If not, why is this happening?

My sssd.conf file is:

# cat /etc/sssd/sssd.conf

[sssd] domains = ad.corp.org config_file_version = 2 services = nss, pam, ssh debug_level = 9

[pam] pam_pwd_expiration_warning = 7 offline_credentials_expiration = 5 debug_level = 9

[domain/ad.corp.org] id_provider = ad auth_provider = ad chpass_provider = ad access_provider = simple ad_server = ad-server1, ad-server2, ad-server3 cache_credentials = true krb5_store_password_if_offline = true default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = false fallback_homedir = /home/%u simple_allow_groups = foo, bar, baz debug_level = 9