Hi,
I am trying to implement the *password must change at next logon* in CentOS 6.5 client using sssd 1.11.6 where Samba 4.1.10 is my backend server.
Here are the list of things which I have done,
1. I have setup the CentOS to do the Domain login using sssd service. I can able to login into the CentOS client using Domain user's credentials from display and from SSH also, no problem at all.
2. Next thing which I want to implement is that password must change feature into Samba 4.1.10 server. To do that, I have been using Windows 7 ultimate which is already in Domain and I am using RSAT tools for users and groups where I have a option to check "password must change at next logon" option for particular user. After doing that Windows machine is honoring this and telling user to change the password and allowing user to login after changing the password.
3. As far as the CentOS client is concerned, it was not honoring the password must change and allowing user to login without asking for password change using sssd with current password.
Here is the configuration file of sssd service,
[sssd] config_file_version = 2 services = nss, pam domains = EXAMPLE sbus_timeout = 30
[nss] filter_users = root filter_groups = root reconnection_retries = 3
[pam] reconnection_retries = 3 offline_credentials_expiration = 0
[domain/EXAMPLE] entry_cache_timeout = 600 entry_cache_group_timeout = 600 min_id = 1000 id_provider = ldap auth_provider = krb5 chpass_provider = krb5 ldap_schema = rfc2307bis ldap_uri = ldap://smbad.intra.example.com:390/ ldap_search_base = dc=intra,dc=example,dc=com cache_credentials = true krb5_server = smbad.intra.example.com:8880 krb5_realm= INTRA.EXAMPLE.COM http://intra.example.com/
ldap_default_bind_dn = cn=admin,dc=intra,dc=example,dc=com
ldap_default_authtok_type = password ldap_default_authtok = 6pNEn7Eo3zmz9MxciGLx
4. I have also tried to achieve above thing using command line tool "pdbedit" but without any luck. Here is the link < http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/passdb.html#pdbed...
which I have followed.
Please share your thoughts in order to help me and move forward to solve this problem.
Thanks very much and regards, Ashishkumar S. Yadav