Description of problem:

On RHEL 7.x, nslcd doesn't seem to send the password expiration notification if the LDAP user doesn't have the objectClass "shadowAccount".

At the customer site with RHEL 6.x,  the notification is sent regardless of the presence of the objectClass "shadowAccount".


Version-Release number of selected component (if applicable):

# rpm -qa | grep nss-pam-ldapd-
nss-pam-ldapd-0.8.13-16.el7.x86_64
#


How reproducible:

Always.


Steps to Reproduce:

1. Add the following LDAP users to an RHDS instance:

User with the objectClass: shadowAccount:
+++++++++++++++++++++++++++++++
dn: uid=tmorris,ou=People,o=Test
cn: Ted Morris
sn: Morris
givenName: Ted
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
ou: Accounting
ou: People
l: Santa Clara
uid: tmorris
mail: tmorris
telephoneNumber: +1 408 555 9187
facsimileTelephoneNumber: +1 408 555 8473
roomNumber: 4117
userPassword: password
manager: uid=dmiller,ou=People,o=Test
loginShell: /bin/bash
uidNumber: 12345
gidNumber: 23456
homeDirectory: /home/tmorris
shadowLastChange: 17748
shadowMax: 10
shadowWarning: 10
+++++++++++++++++++++++++++++++

User without the objectClass: shadowAccount:
+++++++++++++++++++++++++++++++
dn: uid=abarnes,ou=People,o=Test
cn: Anne-Louise Barnes
sn: Barnes
givenName: Anne-Louise
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
ou: Payroll
ou: People
l: Santa Clara
uid: abarnes
mail: abarnes
telephoneNumber: +1 408 555 9445
facsimileTelephoneNumber: +1 408 555 4661
roomNumber: 2290
userPassword: password
manager: uid=abergin,ou=People,o=Test
loginShell: /bin/bash
uidNumber: 10002
gidNumber: 23456
homeDirectory: /home/abarnes
+++++++++++++++++++++++++++++++


2. Edit the nslcd.conf file to configure the connection settings to the LDAP server

3. Configure the RHDS instance to send the password expiration notification:
+++++++++++++++++++++++++++++++
passwordExp: on
passwordMaxAge: 864000
passwordWarning: 864000
passwordSendExpiringTime: on
+++++++++++++++++++++++++++++++

4. Check that the notifications are sent when using the relevant LDAP control:

# ldapsearch -xLLL  -p <PORT> -h <HOST> -b "ou=People,o=Test" -D"uid=abarnes,ou=People,o=Test" -W "uid=abarnes"  -e ppolicy 1.1
Enter LDAP Password:
ldap_bind: Success (0) (Password expires in 863979 seconds)
dn: uid=abarnes,ou=People,o=Test

#
# ldapsearch -xLLL  -p <PORT> -h <HOST> -b "ou=People,o=Test" -D"uid=tmorris,ou=People,o=Test" -W "uid=tmorris" -e ppolicy 1.1
Enter LDAP Password:
ldap_bind: Success (0) (Password expires in 861552 seconds)
dn: uid=tmorris,ou=People,o=Test

#

5. SSH to the localhost and check whether the notifications are sent or not:

# ssh abarnes@localhost
abarnes@localhost's password:
Last login: Sun Aug  5 16:07:45 2018 from localhost
-bash-4.2$
-bash-4.2$ exit
logout
Connection to localhost closed.
#
# ssh tmorris@localhost
tmorris@localhost's password:
password will expire in 10 days
Last login: Sun Aug  5 16:07:55 2018 from localhost
-bash-4.2$


Actual results:

The notification is sent only for the user that has the objectClass "shadowAccount".


Expected results:

Customer expects the same behavior as with RHEL 6.x ie the notifications are sent
even if the objectClass "shadowAccount" is not present.

Additional info: