Red Hat Bugzilla – Bug 697695
Account policy plug-in affects the password policy attributes.
Last modified: 2015-01-04 18:48:06 EST
Since RHEL 6.1 External Beta has begun, and this bug remains unresolved, it has been rejected as it is not proposed as exception or blocker. Red Hat invites you to ask your support representative to propose this request, if appropriate and relevant, in the next release of Red Hat Enterprise Linux.
I tried to reproduce this issue, and everything is working as designed. I believe I know why it looked like it was not behaving correctly. When using password expiration, the expiration time is reset first time a user does a bind after a password change. The expiration time is updated by adding the passwordWarning period to the existing expiration time. By default, this is 1 day. This means that a password will not expire for 1 day and 30 seconds if you set a 30 second expiration period and you bind within 30 seconds of changing the password (unless you change the passwordWarning value). I believe that this was happening, which made it look like the Account Policy plug-in was overriding the password policy. The best way to do this test is to set passwordWarning to 0 in the password policy. This will ensure that the password expires after 30 seconds as expected. Closing as NOTABUG.