[DIRSERVER-2131] cannot log in with ads-pwdmustchange true

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.0.0-M21
• Component/s: ppolicy
• Environment: centos 7.
• Assignee: Unassigned
• Reporter: Peter Jamieson
• Created: 07/Mar/16 15:47
• Updated: 30/Jun/19 04:59

Description

If i modify the authentication policy to set ads-pwdmustchange to TRUE, when i log in, i get: -

provisioning:root *#ssh user2@192.168.56.164
Authorized users only. All activity may be monitored and reported.
user2@192.168.56.164's password:
Password expired. Change your password now.
Last login: Mon Mar  7 15:46:02 2016 from provisioning
Authorized users only. All activity may be monitored and reported.
WARNING: Your password has expired.
You must change your password now and login again!
Changing password for user user2.
Current Password:
New password:
Retype new password:
Password change failed. Server message: Cannot find an entry for DN uid=user2,ou=users,dc=example,dc=com
passwd: Authentication token manipulation error
Connection to 192.168.56.164 closed.

and this appears in the apacheds.log: -
[15:46:33] ERROR [org.apache.directory.server.ldap.handlers.extended.PwdModifyHandler] - Cannot find an entry for DN uid=user2,ou=users,dc=example,dc=com, exception : password needs to be reset before performing this operation