Red Hat Bugzilla – Bug 234593
pam_krb5 does not update the last password change date field in LDAP
Last modified: 2008-02-25 17:59:45 EST
Description of problem:
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Run authconfig-tui and set up the "Use LDAP" checkbox under "User
Information", check the "Use Kerberos" checkbox under "Authentication". Then
press "Next" and enter the address of the LDAP server. Press "Next" again and
enter the address of the Kerberos server.
2. Set expiration time for some existing user (or a new one) to some small value
(so that it expires): passwd -x 1 user
3. Try logging in as that user. You should get a message that your password has
expired and you must change it and then relogin. Change the password.
4. Try logging in again.
You will get again the same message. No matter how many times you change your
password, it keeps saying it is expired.
Should let the user log in after the password is changed.
The "getent shadow|grep user" command will display the shadow line for the
respective user. After you change the password with 'passwd', the third field
does not change (which is the last password change date).
I'm not sure if it's a bug in pam_krb5 or in the implementation of the
putspent() glibc function which should update the respective field in LDAP.
Created attachment 151278 [details]
my system-auth file just in case
I'm not really sure how pam_krb5 has anything to do with your user's password if
the information is stored in the directory server. Did you mean to report this
against the nss_ldap package, which contains the pam_ldap module?
Assuming you're using pam_ldap, can you verify that binding to the directory
server as the user allows you to update the "shadowLastChange" attribute in the
I'm closing this. It's old and I ran into the same problem. Fedora Directory
Server by default does not allow the user to modify shadowLastChange. Changing
this is FDS allows it to work.