Directory Server has its own internal password policy that it manages itself.  It does not communicate with other services.  389's password policy does say why it rejects passwords.  But in IPA deployments IPA also has its own unique password policy plugin, and it does NOT use 389's password policy. 

On 6/19/20 5:10 AM, Nicolas Martin wrote:

I enabled password complexity constraints, password history and password expiration (1 days min, 70 days max).

When I use the command passwd to change a user's password, I get the error message:

Password change failed. Server message: Failed to update password

passwd: Authentication token is no longer valid; new one required

This is not how 389 responds to invalid passwords, so this must be how sssd/ipa responds to invalid passwords.

In the following cases:

Password was changed less than a days ago

Password does not match complexity constraints

Password is already in history

My question: would it be possible to give better information to the user ? To let him know that his password is not matching constraints, already in history or changed recently ?

I realize that some of this is related to sssd/pam, but I'd like to know if 389 server is at least able to tell this to sssd/pam.

Like I said sssd/pam do not use 389's password policies, so I would ask this question on




Nicolas Martin

389-users mailing list --
To unsubscribe send an email to
Fedora Code of Conduct:
List Guidelines:
List Archives:

389 Directory Server Development Team