Description Arvid Requate 2013-03-20 15:25:43 CET

The behaviour for pam password change against ssh (in a Samba4 domain) is a bit strange:

1. It differs between initial created user and repeated password changes
2. The repeated password change dialog has some pretty non-intuitive behaviour. Looks like first pam_unix changes the password and then pam_krb5 comes and says "Hey, you got to cahnge you password!" -- but then it does nothing.

It works in the end, but usability is a bit strange:

## Step 1: create a user who needs to change the password on first login
root@slave12:~# udm users/user create --position "cn=users,$ldap_base" --set username=user7 --set lastname=univention --set password=Univention.99 --set pwdChangeNextLogin=1
## Allow ssh login for him
root@slave12:~# ucr set auth/sshd/user/user7=yes
Create auth/sshd/user/user8
File: /etc/security/access-sshd.conf

## Step 2: first login: OK
arequate@lagra:~$ ssh 10.200.8.12 -l user7   ## try a login
Password: <Univention.99>
You are required to change your password immediately (password aged)
Current Kerberos password: <Univention.99>
Your password will expire at Thu Jan  1 01:00:00 1970

Password: <q1w2e3R$>
Retype new password: <q1w2e3R$>
X11 forwarding request failed on channel 0
user7@slave12:~$
user7@slave12:~$ Abgemeldet
Connection to 10.200.8.12 closed.


## Step 3: user needs to change the password on next login again
root@master10:~#  udm users/user modify --dn uid=user7,cn=users,dc=arucs31i0,dc=qa --set pwdChangeNextLogin=1


## Setup 4: next password change: Strange..
arequate@lagra:~$ ssh 10.200.8.12 -l user7
Password: <q1w2e3R$>
Your password will expire at Thu Jan  1 01:00:00 1970

Changing password
New password: : <Univention.99>
Repeat new password: : <Univention.99>
Success: Password changed

You are required to change your password immediately (password aged)
Current Kerberos password: <IT DOESN'T MATTER WHAT YOU ENTER HERE>
Password: <Univention.99>
X11 forwarding request failed on channel 0
Last login: Wed Feb 13 05:40:29 2013 from lagra.knut.univention.de
user7@slave12:~$

+++ This bug was initially created as a clone of Bug #29438 +++