freeipa

#9905 ipa-graceperiod plugin should allow password change coming through Kerberos in case of grace time set to 0 for OTP-enabled users
Opened by abbra. Modified

Open
Close Issue

When OTP-enabled user gets their password expired, they need to change it even in the grace time 0 situation. From SSSD this will look like a Kerberos principal password change which ends up first doing an ipa-otpd LDAP bind with OTP enabled.

ipa-graceperiod plugin does not handle any situation like that. I think we need to review the code and see how to improve OTP binds' handling.

Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.