Directory Server has its own internal password policy that it manages
itself. It does not communicate with other services. 389's password
policy does say why it rejects passwords. But in IPA deployments IPA
also has its own unique password policy plugin, and it does NOT use
389's password policy.
On 6/19/20 5:10 AM, Nicolas Martin wrote:
I enabled password complexity constraints, password history and
password expiration (1 days min, 70 days max).
When I use the command passwd to change a user's password, I get the
Password change failed. Server message: Failed to update password
passwd: Authentication token is no longer valid; new one required
This is not how 389 responds to invalid passwords, so this must be how
sssd/ipa responds to invalid passwords.
In the following cases:
Password was changed less than a days ago
Password does not match complexity constraints
Password is already in history
My question: would it be possible to give better information to the
user ? To let him know that his password is not matching constraints,
already in history or changed recently ?
I realize that some of this is related to sssd/pam, but I'd like to
know if 389 server is at least able to tell this to sssd/pam.
Like I said sssd/pam do not use 389's password policies, so I would ask
this question on freeipa-users(a)lists.fedorahosted.org
389-users mailing list -- 389-users(a)lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
389 Directory Server Development Team