Hi Aaron,

I'm not sure what version of 389 you are using but it works for me on the latest version if I enable grace logins.  Here are my settings:

cn=config ... passwordChange: on passwordGraceLimit: 2 passwordExp: on passwordMaxAge: 30

$ ldapmodify -H ldap://localhost:389 -D "cn=mark,ou=people,dc=example,dc=com" -w password control: 2.16.840.1.113730.3.4.4 false MA== # PasswordExpired control dn: cn=mark,ou=people,dc=example,dc=com changetype: modify replace: userpassword userpassword: Secret123

modifying entry "cn=mark,ou=people,dc=example,dc=com"

HTH,

Mark

On 11/8/23 9:55 AM, Aaron Enders wrote:

Hello,

Question: Is there a way to allow users to change their password if the password has already expired?

I've been fighting this issue for months now and havn't found a resolution. My users are able to change their password if it is not expired however once expired even in the Grace login period they are unable to change due to anonomus binds not allowed. Is there an ACI that would apply here? My problem is I use a VPN solution which only allerts the users the password is expiring however they do not have a way to change.

Thanks Aaron _______________________________________________ 389-users mailing list -- 389-users@lists.fedoraproject.org To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue