We host a 389ds LDAP service and connect it via SSSD. All servers and clients are on CentOS 7. ldapmodify and passwd work well. But we fail to change user login shell via chsh. For example,
$ chsh -s /bin/bash
Changing shell for hpc-jianwen.
chsh: user "hpc-jianwen" does not exist.
man page for `chsh` says:
chsh supports non-local entries (kerberos, LDAP, etc.) if linked with libuser, otherwise use ypchsh, lchsh or any other implementation for non-
-- "if linked with libuser" -- is this a case in your setup?