Handle expired passwords like other PAM modules

So far we handled expired password during authentication. Other PAM
modules typically detect expired password during account management and
return PAM_NEW_AUTHTOK_REQD if the password is expired and should be
changed. The PAM library then calls the change password routines. To
meet these standards pam_sss is change accordingly.

As a result it is now possible to update an expired password via ssh if
sssd is running with PasswordAuthentication=yes. One drawback due to
limitations of PAM is that the user now has to type his current password
again before setting a new one.

1 files changed, 1 insertions, 1 deletions

diff --git a/src/providers/ldap/ldap_auth.c b/src/providers/ldap/ldap_auth.c
index cfe8adb97..ba1136bdd 100644
--- a/src/providers/ldap/ldap_auth.c
+++ b/src/providers/ldap/ldap_auth.c
@@ -983,7 +983,7 @@ static void sdap_pam_auth_done(struct tevent_req *req)
         state->pd->pam_status = PAM_ACCT_EXPIRED;
         break;
     case SDAP_AUTH_PW_EXPIRED:
-        state->pd->pam_status = PAM_AUTHTOK_EXPIRED;
+        state->pd->pam_status = PAM_NEW_AUTHTOK_REQD;
         break;
     default:
         state->pd->pam_status = PAM_SYSTEM_ERR;