I have a replication setup (389 and AD):
We are implementing password police on both side (and password expiration).
When the account has expired on AD side (It means that on AD side I have
the flag "user must change password" set on an user) , when I try to change
password on 389 side, I see the following error:
[03/Jul/2017:10:47:07 -0300] NSMMReplicationPlugin - windows sync -
agmt="cn=AD - GTI-DF-DC01" (gti-df-dc01:636): AD entry CN=Teste
Marcelo,OU,test,DC=my,DC=domain set "user must change password at next
And the password is not changed on AD side.
I thought that could be something about permission on my replication login,
so I made a script in perl to change password directly on my AD, and with
this script (using the same login that I uses on my replication) the
password is changed.
Can you detail me a little bit better how replication occurs? Or point me
why when this flag is set the replication plugin is not be able to change
the password on AD side?
My first guess is:
The replication plugin try to bind this user first (to check if the user
already has this password) and when receives this error (user must change
password), so it does not try to change the password.