Handle expired passwords like other PAM modules

So far we handled expired password during authentication. Other PAM
modules typically detect expired password during account management and
return PAM_NEW_AUTHTOK_REQD if the password is expired and should be
changed. The PAM library then calls the change password routines. To
meet these standards pam_sss is change accordingly.

As a result it is now possible to update an expired password via ssh if
sssd is running with PasswordAuthentication=yes. One drawback due to
limitations of PAM is that the user now has to type his current password
again before setting a new one.

1 files changed, 1 insertions, 1 deletions

diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index d1cc53fd..08df5984 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -688,7 +688,7 @@ static errno_t tgt_req_child(int fd, struct krb5_req *kr)
                     pam_status = PAM_AUTHINFO_UNAVAIL;
                     break;
             case KRB5KDC_ERR_KEY_EXP:
-                    pam_status = PAM_AUTHTOK_EXPIRED;
+                    pam_status = PAM_NEW_AUTHTOK_REQD;
                     break;
             case KRB5KDC_ERR_PREAUTH_FAILED:
                     pam_status = PAM_CRED_ERR;