Bug 190256

Description of problem:
If a ldap account has expired, pam_ldap won't force the change.

Version-Release number of selected component (if applicable):
pam_ldap revision 176.
RHEL4 package: nss_ldap-226-10-i386

How reproducible:
Always.

Steps to Reproduce:
1.Setup users on an LDAP server (Customer: RHEL4 LDAP Server running NSDSv7.1)
2.Reset a user password.
3.Console shows flashing: 
 Change after reset
 Permission Denied

Actual results:
Impossible to login.

Expected results:
User should be forced to change its password.


Additional info:
The customer has also opened a bugzilla with PADL Software.
More data from their report :

From /var/log/messages:

Jun 16 10:39:27 lulu gpm[2258]: *** info [mice.c(1766)]:
Jun 16 10:39:27 lulu gpm[2258]: imps2: Auto-detected intellimouse PS/2
Jun 16 10:39:35 lulu unix_chkpwd[28399]: check pass; user unknown
Jun 16 10:39:35 lulu login(pam_unix)[28263]: authentication failure;
logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost=  user=tfalgout
Jun 16 10:39:35 lulu unix_chkpwd[28400]: could not get username from shadow
(tfalgout))
Jun 16 10:39:35 lulu login[28263]: Permission denied
Jun 16 10:39:35 lulu init: open(/dev/pts/0): No such file or directory
Nothing logged to /var/log/secure

The login pam module:

#%PAM-1.0
auth       required     pam_securetty.so
auth       required     pam_stack.so service=system-auth
auth       required     pam_nologin.so
account    required     pam_stack.so service=system-auth
password   required     pam_stack.so service=system-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_stack.so service=system-auth
session    optional     pam_console.so
# pam_selinux.so open should be the last session rule
session    required     pam_selinux.so multiple open
session    required     pam_mkhomedir.so skel=/etc/skel umask=0077
The system-auth pam module (created by authconfig):


#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      /lib/security/$ISA/pam_env.so
auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
auth        sufficient    /lib/security/$ISA/pam_ldap.so use_first_pass
auth        required      /lib/security/$ISA/pam_deny.so
account     required      /lib/security/$ISA/pam_unix.so broken_shadow
account     sufficient    /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet
account     [default=bad success=ok user_unknown=ignore]
/lib/security/$ISA/pam_ldap.so
account     required      /lib/security/$ISA/pam_permit.so
password    requisite     /lib/security/$ISA/pam_cracklib.so retry=3
password    sufficient    /lib/security/$ISA/pam_unix.so nullok use_authtok md5
shadow
password    sufficient    /lib/security/$ISA/pam_ldap.so use_authtok
password    required      /lib/security/$ISA/pam_deny.so

session     required      /lib/security/$ISA/pam_limits.so
session     required      /lib/security/$ISA/pam_unix.so
session     optional      /lib/security/$ISA/pam_ldap.so