Hello,
please see attached patches resolving
https://fedorahosted.org/sssd/ticket/2167
1st patch contains some minor refactoring useful for 2nd patch.
How to test:
On OpenLDAP following attributes should be set:
* shadowMax - how many days after shadowLastChange will password expire
* shadowWarning - how many days before password expires should warning
be displayed.
In sssd.conf domain section should contain something similar to:
access_provider = ldap
ldap_access_order = expire, expire_policy
ldap_account_expire_policy = shadow
ldap_pwd_policy = shadow
Thanks!