didier[~]$ file /usr/lib64/kde4/libexec/kcheckpass 
/usr/lib64/kde4/libexec/kcheckpass: setuid, setgid ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, stripped
didier[~]$

#!/bin/bash

# This script is run by KDE when the the screenlocker timeout expires and a password is requested.

# Determine if the user is a domain user or local user

x=`cut -d: -f1 /etc/passwd | grep $USER`

# If a local user, run the standard kcheckpass

if [ -n "$x" ]
then
    `dirname $0`/kcheckpass.kde $*
    rc=$?
    exit $rc
fi

# get the file descriptor for retrieving the password entered
# This will be a command line argument "-S <fd>"

while [ 1 == 1 ]
do
  if [ -z "$1" ]        # no more args, bad!
  then
      exit 4
  fi

  x=`echo $1 | cut -c1-2`
  
  if [ "$x" = "-S" ]    # found the file descriptor parameter
  then
      fd="$2"
      break
  fi

  shift
done

# Now, get password entered by user

passwd=`$(dirname $0)/getkcheckPW $fd`
x=`ntlm_auth --username="$USER" --password="$passwd" 2>&1`
rc=$?

y=`echo "$x" | grep PASSWORD_EXPIRED`

# If expired, let the user log in anyway. Otherwise, no way to change PW
# A subsequent login attempt will force it.

if [ -n "$y" ]; then rc=0; fi

# THE FOLLOWING APPEARS TO BE NOT NECESSARY. THE EXIT $rc
# CAUSES A PW CHANGE TO BE INITIATED.
##########################################################
# Login Failed. See if the problem is an expired password.

#if [ "$rc" != 0 ]
#then
#    y=`echo "$x" | grep PASSWORD_EXPIRED`

#    if [ -n "$y" ]     # Yes, expired. Get new password
#    then
#        /user/util/bin/newpass "$USER" "$passwd"
#        rc=$?
#    fi
#fi    

exit $rc

#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>

main(int argc, char *argv[])
{
    int fd;                     /* file descriptor */
    int convGetHidden = 2;      /* code give to (presumably) kscreenlocker_greet for type of ... */
    int cnt;
    int l;                      /* length of password */
    char passwd[80];            /* buffer to hold returned password */

    if (argc < 2) exit(-1);     /* expecting file descriptor as arg */
    fd = atoi(argv[1]);

    write(fd, &convGetHidden, sizeof(convGetHidden));   /* conv_server type ... */

    /* kcheckpass.c sends a prompt of zero length for convGetHidden */
    cnt = 0;
    write(fd, &cnt, sizeof(cnt));

    cnt = read(fd, &l, sizeof(l));      /* Get length of entered password */
    cnt = read(fd, passwd, l);          /* Get password */
    printf("%s\n", passwd);
    exit(0);
}