Bug 234593

Summary: pam_krb5 does not update the last password change date field in LDAP
Product: [Fedora] Fedora Reporter: Andrew Zabolotny <anpaza>
Component: nss_ldapAssignee: Nalin Dahyabhai <nalin>
Status: CLOSED NOTABUG QA Contact: Brian Brock <bbrock>
Severity: medium Docs Contact:
Priority: medium    
Version: 6   
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-02-25 22:59:45 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
my system-auth file just in case none

Description Andrew Zabolotny 2007-03-30 13:32:22 UTC 
Description of problem:


Version-Release number of selected component (if applicable):
pam_krb5-2.2.11-1

How reproducible:
Always

Steps to Reproduce:
1. Run authconfig-tui and set up the "Use LDAP" checkbox under "User
Information", check the "Use Kerberos" checkbox under "Authentication". Then
press "Next" and enter the address of the LDAP server. Press "Next" again and
enter the address of the Kerberos server.
2. Set expiration time for some existing user (or a new one) to some small value
(so that it expires): passwd -x 1 user
3. Try logging in as that user. You should get a message that your password has
expired and you must change it and then relogin. Change the password.
4. Try logging in again.
  
Actual results:
You will get again the same message. No matter how many times you change your
password, it keeps saying it is expired.

Expected results:
Should let the user log in after the password is changed.

Additional info:
The "getent shadow|grep user" command will display the shadow line for the
respective user. After you change the password with 'passwd', the third field
does not change (which is the last password change date).

I'm not sure if it's a bug in pam_krb5 or in the implementation of the
putspent() glibc function which should update the respective field in LDAP.
Comment 1 Andrew Zabolotny 2007-03-30 13:32:23 UTC 
Created attachment 151278 [details]
my system-auth file just in case
Comment 2 Nalin Dahyabhai 2007-03-30 14:21:52 UTC 
I'm not really sure how pam_krb5 has anything to do with your user's password if
the information is stored in the directory server.  Did you mean to report this
against the nss_ldap package, which contains the pam_ldap module?

Assuming you're using pam_ldap, can you verify that binding to the directory
server as the user allows you to update the "shadowLastChange" attribute in the
user's entry?
Comment 3 Orion Poplawski 2008-02-25 22:59:45 UTC 
I'm closing this.  It's old and I ran into the same problem.  Fedora Directory
Server by default does not allow the user to modify shadowLastChange.  Changing
this is FDS allows it to work.