Description of problem:

When changing an expired password while using referrals, if the server actually changes the password while sending referrals, pam_ldap assumes that the password is changed and overwrites it.  However, the referral to the master is not yet chased, so binding to the master fails, thereby causing the password change to ultimately fail.

Version-Release number of selected component (if applicable):

nss_ldap-253-13.1

How reproducible:

Always

Steps to Reproduce:
1. Set up two fedora-DS servers, one a master, and one a slave.
2. Set up a referral from the slave to the master
3. Set up an expired user account.
4. Try to ssh to a server using the slave, and reset the password when requested
     (using exop).
5. Master fails the update with "invalid credentials".
  
Actual results:


Expected results:


Additional info:

The problem appears to be in the _update_authtok routine.  Commenting out the final block of code starting on line 3117:

/*  if (rc == LDAP_SUCCESS)
    {
      _pam_overwrite (session->info->userpw);
      _pam_drop (session->info->userpw);
      session->info->userpw = strdup (new_password);
      if (session->info->userpw == NULL)
        {
          rc = PAM_BUF_ERR;
        }
    } */

Appears to fix the problem.  I get "can't update shadowLastChange" after that, but it appears to be a different problem, and I can at least log in.

The fix I made is probably insecure.  Please work with me to find the correct fix.  I actually have support with redhat through my company, I will pass this bug report number on to our rep.  thanks.