I am having a problem with sssd (1.9.2) and passwords expiration against IPA v.3.0.0-37. I have setup sssd to use IPA with LDAP not Kerberos since this is in EC2 and I don’t want to deal with assigning tickets to each ephemeral host. So far things are working great, with the one exception that due to IPA using “krbPasswordExpiration” instead of “shadowExpire” breaks the usage of expired passwords. I tried setting “ldap_pwd_policy = mit_kerberos”, which does allow expired passwords to be recognized, but then breaks the users ability to change passwords. I suspect it causes sssd to use al Kerberos code paths, which won’t work in this case. If anyone has any ideas on this I would appreciate and feedback. Thanks in advance.
example conf
[domain/LDAP] enumerate = true cache_credentials = True debug_level = 9
id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_schema = IPA
ldap_uri = ldaps://ipa-use-1b.ec2.example.net ldap_user_search_base = dc=example,dc=net ldap_id_use_start_tls = true tls_reqcert = demand ldap_tls_cacert = /etc/ipa/ca.crt
ldap_user_ssh_public_key = ipaSshPubKey #ldap_pwd_policy = shadow #ldap_user_shadow_expire = krbPasswordExpiration #ldap_pwd_policy = mit_kerberos
[sssd] services = nss, pam, ssh config_file_version = 2
domains = LDAP [nss]
[pam]
[sudo]
[autofs]
[ssh]
[pac]
sssd-users@lists.fedorahosted.org