User can't change expired password

Question

Hi,
Using Solaris 9 Clients and DS 5.2p4.
In my old NIS+ installation users with expired passwords (not expired accounts!!) where foreced to change their password during login.
Now using ldap naming service, such users are NOT asked to change their passwords, they just can't login, seeing:
Your password has expired.
Access denied
Using keyboard-interactive authentication.
Password:Is this a bug, a feature or do I need to change my config?
my pam.conf looks like:
other   auth requisite          pam_authtok_get.so.1
other   auth required           pam_dhkeys.so.1
other   auth binding            pam_unix_auth.so.1 server_policy
other   auth required           pam_ldap.so.1 use_first_pass
other   account requisite       pam_roles.so.1
other   account required        pam_projects.so.1
other   account required        pam_unix_account.so.1 server_policy
other   account required        pam_ldap.so.1
other   password required       pam_dhkeys.so.1
other   password requisite      pam_authtok_get.so.1
other   password requisite      pam_authtok_check.so.1
other   password required       pam_authtok_store.so.1 server_policyThe only workarround I found so far is, to change the account flag to optional
other   account optional        pam_ldap.so.1This allows the user to login, but he is still not forces to change his password.

Answer 1

There is a way arround.
The password policy which appies to this user needs to have passwordExpireWithoutWarning=off.Than the user gets a "new chance". His passwordexpirationtime gets expended to the current date + passwordWarning periode. This allows the user to login and change his password. In adddition passwordexpwarned=1 for this user is set, to prevent doing this over and over.
See Sun Document 75326
http://sunsolve.sun.com/search/document.do?assetkey=1-25-75326-1
Message was edited by:
mzeilinger