Description of problem:

When LDAP password expires and account is locked without grace as per LDAP password policy SSSD would erroneously attempt LDAP password modify extended operation on a connection where BIND operation has previously failed (due to described password policy state).

(2022-11-01 12:13:33): [be[test.com]] [simple_bind_send] (0x0100): [RID#54262] Executing simple bind as: uid=ipresovs,ou=people,dc=test,dc=com
(2022-11-01 12:13:33): [be[test.com]] [simple_bind_done] (0x1000): [RID#54262] Password Policy Response: expire [-1] grace [-1] error [Password expired].
(2022-11-01 12:13:33): [be[test.com]] [simple_bind_done] (0x1000): [RID#54262] Password expired user must set a new password.
(2022-11-01 12:13:33): [be[test.com]] [simple_bind_done] (0x1000): [RID#54262] Password expired user must set a new password.
(2022-11-01 12:13:33): [be[test.com]] [simple_bind_done] (0x0400): [RID#54262] Bind result: Invalid credentials(49), password expired!
(2022-11-01 12:13:33): [be[test.com]] [sdap_pam_chpass_handler_auth_done] (0x1000): [RID#54262] user [uid=ipresovs,ou=people,dc=test,dc=com] successfully authenticated.
(2022-11-01 12:13:33): [be[test.com]] [sdap_exop_modify_passwd_send] (0x0100): [RID#54262] Executing extended operation
(2022-11-01 12:13:33): [be[test.com]] [sdap_exop_modify_passwd_done] (0x0200): [RID#54262] Server returned no controls.
(2022-11-01 12:13:33): [be[test.com]] [sdap_exop_modify_passwd_done] (0x0080): [RID#54262] ldap_extended_operation result: Insufficient access(50), Anonymous Binds are not allowed.

Version-Release number of selected component (if applicable):

sssd-2.6.2-4.el8_6.1.x86_64

Expected results:

SSSD should not try LDAP password modify extended operation after BIND failure because it is essentially issuing that operation as anonymous LDAP user.

It should instead provide a meaningful error message indicating that the password is expired and account is locked and needs to be reset by a privileged LDAP user.