Debian – Cannot enforce password change in OpenLDAP with Password Policy Overlay

debianopenldappassword-managementpassword-policy

I've implemented Password Policy Overlay on OpenLDAP on Debian Stable. The server side and the policies are working as expected. However, after expiration I cannot force users to change their passwords. User logs in, gets a message that their password is expired and must be immediately changed. However both in local login and SSH login, user is kicked out. Client side is using libnss_ldap, pam_ldap. pwdMustChange, pwdAllowUserChange is both set to true. Using passwd to change passwords is also working as expected.

Client Side Configuration Files

/etc/nsswitch.conf:

passwd:         files ldap
group:          files ldap
shadow:         files

/etc/pam.d/common-account:

account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so
account [success=1 default=ignore] pam_ldap.so
account requisite pam_deny.so
account required pam_permit.so

/etc/pam.d/common-auth:

auth [success=2 default=ignore] pam_unix.so nullok_secure
auth [success=1 default=ignore] pam_ldap.so use_first_pass
auth requisite pam_deny.so
auth required pam_permit.so

/etc/pam.d/common-password:

password [success=2 default=ignore] pam_unix.so obscure sha512
password [success=1 user_unknown=ignore default=die] pam_ldap.so try_first_pass

/etc/pam.d/common-password:

session [default=1] pam_permit.so
session requisite pam_deny.so
session required pam_permit.so
session required pam_mkhomedir.so umask=0022 skel=/etc/skel
session required pam_unix.so 
session optional pam_ldap.so

/etc/libnss-ldap.conf:

base dc=testldap,dc=example,dc=com
uri ldap://192.168.56.102/
ldap_version 3
pam_lookup_policy yes
pam_password exop

/etc/pam_ldap.conf:

base dc=testldap,dc=example,dc=com
uri ldap://192.168.56.102/
ldap_version 3
pam_lookup_policy yes
pam_password exop

Any ideas?

Best Answer

I've solved the problem. Only thing I needed to do is to add new_authtok_reqd=done do the LDAP line in the common-account file. So, the resulting file looks like the following and everything is working is expected:

account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so
account [success=1 new_authtok_reqd=done default=ignore] pam_ldap.so
account requisite pam_deny.so
account required pam_permit.so
Related Topic