Re: [SSSD-users] Password Must Change using SSSD in Samba 4.1.10

[Sumit Bose]

On Wed, Jan 07, 2015 at 03:48:16PM +0530, Ashish Yadav wrote:
> Hi,
>
> I am trying to implement the *password must change at next logon* in CentOS
> 6.5 client using sssd 1.11.6 where Samba 4.1.10 is my backend server.
>
> Here are the list of things which I have done,
> I have setup the CentOS to do the Domain login using sssd service. I can
>
> able to login into the CentOS client using Domain user's credentials from
> display
> and from SSH also, no problem at all.
> Next thing which I want to implement is that password must change
>
> feature into Samba 4.1.10 server. To do that, I have been using Windows 7
> ultimate
> which is already in Domain and I am using RSAT tools for users and groups
> where I have a option to check "password must change at next logon" option
> for particular user.
> After doing that Windows machine is honoring this and telling user to
> change the password and allowing user to login after changing the password.
> As far as the CentOS client is concerned, it was not honoring the
>
> password must change and allowing user to login without asking for password
> change using sssd with current password.
>
> Here is the configuration file of sssd service,
>
> [sssd]
> config_file_version = 2
> services = nss, pam
> domains = EXAMPLE
> sbus_timeout = 30
>
> [nss]
> filter_users = root
> filter_groups = root
> reconnection_retries = 3
>
> [pam]
> reconnection_retries = 3
> offline_credentials_expiration = 0
>
> [domain/EXAMPLE]
> entry_cache_timeout = 600
> entry_cache_group_timeout = 600
> min_id = 1000
> id_provider = ldap
> auth_provider = krb5
> chpass_provider = krb5
> ldap_schema = rfc2307bis
> ldap_uri = ldap://smbad.intra.example.com:390/
> ldap_search_base = dc=intra,dc=example,dc=com
> cache_credentials = true
> krb5_server = smbad.intra.example.com:8880
> krb5_realm= INTRA.EXAMPLE.COM http://intra.example.com/
>
> ldap_default_bind_dn = cn=admin,dc=intra,dc=example,dc=com
>
> ldap_default_authtok_type = password
> ldap_default_authtok = 6pNEn7Eo3zmz9MxciGLx
> I have also tried to achieve above thing using command line tool
>
> "pdbedit" but without any luck. Here is the link <
> http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/passdb.html#pdbed...
> >
>
> which I have followed.
>
> Please share your thoughts in order to help me and move forward to solve
> this problem.

What happens if you call

kinit [e-mail]

on the Linux command line. Are you asekd you for new password here? If
not Samba might not return the right error code to indicate that the
password is expired. In this case it would be nice if you can send the
output of

KRB5_TRACE=/dev/stdout  kinit [e-mail]

bye,
Sumit
> Thanks very much and regards,
> Ashishkumar S. Yadav
> sssd-users mailing list
> [e-mail]
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users