Hi,

I am trying to implement the *password must change at next logon* in CentOS
6.5 client using sssd 1.11.6 where Samba 4.1.10 is my backend server.

Here are the list of things which I have done,

1. I have setup the CentOS to do the Domain login using sssd service. I can able to login into the CentOS client using Domain user’s credentials from display and from SSH also, no problem at all.

2. Next thing which I want to implement is that password must change feature into Samba 4.1.10 server. To do that, I have been using Windows 7
ultimate which is already in Domain and I am using RSAT tools for users and groups where I have a option to check “password must change at next logon” option for particular user. After doing that Windows machine is honoring this and telling user to change the password and allowing user to login after changing the password.

3. As far as the CentOS client is concerned, it was not honoring the password must change and allowing user to login without asking for password change using sssd with current password.

Here is the configuration file of sssd service,

[sssd]
config_file_version = 2
services = nss, pam domains = EXAMPLE
sbus_timeout = 30

[nss]
filter_users = root filter_groups = root reconnection_retries = 3

[pam]
reconnection_retries = 3
offline_credentials_expiration = 0

[domain/EXAMPLE]
entry_cache_timeout = 600
entry_cache_group_timeout = 600
min_id = 1000
id_provider = ldap auth_provider = krb5
chpass_provider = krb5
ldap_schema = rfc2307bis ldap_uri = ldap://smbad.intra.example.com:390/
ldap_search_base = dc=intra,dc=example,dc=com cache_credentials = true krb5_server = smbad.intra.example.com:8880
krb5_realm= INTRA.EXAMPLE.COM

ldap_default_bind_dn = cn