Fixed upstream:
master: https://fedorahosted.org/freeipa/changeset/0e8a329048629f639ae64ff32e01e12a495e7763
ipa-3-1: https://fedorahosted.org/freeipa/changeset/4d17b7217256996c51b579504f47b9d1ef037f04

IPA Kerberos LDAP driver now caps krbPasswordExpiration time on 2038-01-01, i.e. a highest representable time in Kerberos. This fixes password change issues when password policy was set to a value setting expiration date after 2038-01-01.

ipa pwpolicy-mod --maxlife accept values up to 2147483647. Maxlife values 999999 and 2147483647 are not applied correctly, ipa pwpolicy-show show them correctly, but user's attribute 'krbpasswordexpiration' is set only 3 months ahead. I expected that policy will be applied correctly or maxlife value will be limited for example to 10000 value.

Linking an upstream ticket https://fedorahosted.org/freeipa/ticket/3817 to fix issue described in Comment 3.

*** Bug 989938 has been marked as a duplicate of this bug. ***

Second issue from Comment 3 fixed, moving BZ to POST until new build is done.

master: https://fedorahosted.org/freeipa/changeset/f954f2d1b92db10113b766759897d66c57e1e3ab

After this change, pwpolicy --maxlife can only be set at maximum to 20000 which is a safe value to process.

bug verified
[root@rh7c (RH7.0-x86_64) ipa-password] rpm -qa | grep ipa-server
ipa-server-3.3.1-5.el7.x86_64


automation in ipa-password test suite
bz_891977()
{       
    rlPhaseStartTest "Bug 891977 - Users cannot change their passwords after password expiry change"                                                                             
        rlLog "please note: bug 891977 is clone of 859510"                              
        local user=bz859510                                                             
        local grp=grp859510                                                             
        local small=1
        local big=10
        local initialPW="redhat_000"                                                    
        local newPW="redhat_001"                                                        
        local latestPW="redhat_002"                                                     
        # preparing test data 
        Local_KinitAsAdmin 
        echo $initialPW | ipa user-add $user --first "bug" --last "859510" --password   
        ipa group-add $grp --desc "group for 859510"
        ipa group-add-member $grp --user=$user
        ipa pwpolicy-add $grp --maxlife=$small --priority=6
        Local_FirstKinitAs $user $initialPW $newPW                                      
        # up to this step, user and group are created, user's password will expire in $small day 
        offset_system_time "+ $small * 24 * 3600"                                       
        Local_KinitAsAdmin
        ipa pwpolicy-mod $grp --maxlife=$big
        kinit_aftermaxlife $user $newPW $latestPW                                       
        rlLog "clean up test data"                                                      
        Local_KinitAsAdmin
        rlRun "ipa group-del $grp"                                                      
        rlRun "ipa user-del $user"                                                      
    rlPhaseEnd                                                                          
}

*** Bug 888579 has been marked as a duplicate of this bug. ***

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.