On Fri, Nov 24, 2017 at 04:57:01PM +1300, Aaron Hicks via
> Hello the list,
> It's here:
> SSSD is not doing its job properly when a user has an expired password and
> an OTP token, and they should reset their password at the ssh prompt.
Yes, SSSD does no behave well with OTP and an expired password and I
agree with you analysis below. The area of code you mentioned above is
not related because it is a special path only used during password
migration (user was migrated from LDAP with the LDAP password hash but
no Kerberos keys).
Would you mind to open a ticket on https://pagure.io/SSSD/sssd/issues