G'day all

Running Centos 6.5, sssd and am using Kerberos for authentication. Have installed the standard Kerberos packages in addition to the oddjob* packages.

authconfig --enablesssd --enablesssdauth --disableldap --disableldapauth --disablekrb5 --update

This sets up pam_sss.o as the main pam module that does all the work. Users can login, Kerberos tickets are created properly, and they get all the appropriate uid/gid/homedirs etc... all that works fine. Note: I am not binding to the domain, so no keytab files are needed. My issue now is when a users AD account password expires, the user is notified when they login but password changes fail because of password complexity failures. Despite the passwords having the correct complexity, something in the layers of software is not permitting the password change. It *should* be handled by the KDC/Domain controllers.

I have a hunch that it has to do with the authtok settings in the sssd.conf file, but cannot find a solution despite trying multiple settings.

Has anyone had experience with Kerberos, sssd on Centos >= 6.5 Shed some light on this issue and you will be rewarded handsomely.

I just want to add that its difficult for me to post a full sssd.conf file and log information as its on a secure network. For brevity, here is the output of an attempted password change, /var/log/secure:

pam_unix(passwd:chauthtok): user userbob does not exist in /etc/passwd
pam_sss(passwd:chauthtok) system info [Generic error(See e-text)]
pam_sss(passwd:chauthtok) User info message: Password change failed complexity etc.........

So pam_unix gives it a go and see's its not a local account, then pam_sss processes the user's password change request. And fails. What the heck is e-text?

The user experience is odd as well. The user is prompted to enter current password, after which is prompted for a new password twice, and all over again twice. Its the second and final time that the error message is displayed that the password doesn't match complexity requirements. On the users tty. To me, there's a PAM issue. authconfig is likely missing a flag, not sure which one.

Enough rambling on