DUP of https://pagure.io/SSSD/sssd/issue/2594

I do not think this is a dup of #2594 because if I understand it correctly your issue is about a warning that the password will expire but #2594 is about a warning that the password is already expired.

What 'ldap_pwd_policy' are you using? Because the man page entry for 'pwd_expire_policy_warn' says '... Also 'ldap_pwd_policy' must be set to an appropriate password policy'.

You might be right that this is not a dup and may have closed this one prematurely.

We are using ppolicy overlay in LDAP. Our LDAP entries do not even have shadow style attributes for password expiration. In which case as far as I can see it will only check if account is locked when access with ssh keys and does not check for password expiration explicitly since that would come from bind operation message.

If the only way the warning can be returned to the client is during the bind operation, then I don't see how sssd can display the warning, because the only way to perform the bind is to know the user's credentials, which we only have during password authentication..

Actually not necessarily that only bind operation can show warning, ppolicy
entry has password expiration (pwdMaxAge) and password expiration warning
(pwdExpireWarning) fields in readable format, ppolicy overlay adds
pseudo-attribute of when the password was last changed (pwdChangedTime).
From there it is simple math if "now - pwdChangedTime >= pwdExpireWarning"
then show the "password will expire" warning if "now - pwdChangedTime >=
pwdMaxAge" show "password already expired" warning.

On Thu, Oct 5, 2017 at 10:33 PM, Jakub Hrozek pagure@pagure.io wrote:

jhrozek added a new comment to an issue you are following:
If the only way the warning can be returned to the client is during the bind operation, then I don't see how sssd can display the warning, because the only way to perform the bind is to know the user's credentials, which we only have during password authentication..

To reply, visit the link below or just reply to this email
https://pagure.io/SSSD/sssd/issue/3522

I'm sorry this issue fell off the track.

Based on the previous comment, you seem to have a good understanding of the problem, would you like to submit a patch?

I might look into that. The patch shouldn't be complicated.

Great, I'm looking forward to the patch!

Great, I'm looking forward to the patch!

Thank you for taking time to submit this request for SSSD. Unfortunately this issue was not given priority and the team lacks the capacity to work on it at this time.

Given that we are unable to fulfill this request I am closing the issue as wontfix.

If the issue still persist on recent SSSD you can request re-consideration of this decision by reopening this issue. Please provide additional technical details about its importance to you.

Thank you for understanding.

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4548

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.