URL:
https://github.com/SSSD/sssd/pull/268
Title: #268: pam_sss: add support for SSS_PAM_CERT_INFO_WITH_HINT
sumit-bose commented:
"""
Yes, I think this is unrelated. I assume you just set the password as admin but did not
use it as the user. In this case the password is expired and must be reset by the user.
It looks that although PKINIT was used for authentication the KDC reply still contains
information about the expired password and SSSD sends a reply to the PAM client to request
a new password.
Can you try to call 'kinit alice(a)sc.ff' to set a new password and then check
Smartcard authentication again. If it then works it is the issue I assumed above and I can
try to fix it in a different ticket.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/268#issuecomment-305430782