I enabled password complexity constraints, password history and password expiration (1 days min, 70 days max).

When I use the command passwd to change a user's password, I get the error message:

Password change failed. Server message: Failed to update password

passwd: Authentication token is no longer valid; new one required

In the following cases:

Password was changed less than a days ago

Password does not match complexity constraints

Password is already in history

My question: would it be possible to give better information to the user ? To let him know that his password is not matching constraints, already in history or changed recently ?

I realize that some of this is related to sssd/pam, but I'd like to know if 389 server is at least able to tell this to sssd/pam.


Nicolas Martin