As an app developer for one of the government institute of the Bangladesh government, I want to implement a web based system using FreeIPA where users so that our organization's government employees can log into their computer as well as web services with a single password which will be stored in FreeeIPA. Our users shouldn't have freeIPA access, but out SSO app does.
Our SSO app will be connected to FreeIPA server to verify user authentication. Also our OS have access to the FreeIPA server through private network. To develop the SSO, we have used PHP Laravel and php-freeipa ( https://github.com/gnumoksha/php-freeipa ) library. I can connect with FreeIPA, can add a user and can set password. But set password is being expired just after it is set according to this ( https://www.freeipa.org/page/New_Passwords_Expired ) policy.
So we need a flag to turn on or off this ( https://www.freeipa.org/page/New_Passwords_Expired ) policy. We have searched in different places but no workaround is found.
Password is expired immediately it is added
Should have a way to turn on or off this module or policy
[abrar@freeipa ~]$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
package freeipa-server is not installed package freeipa-client is not installed ipa-server-4.6.5-11.el7.centos.3.x86_64 ipa-client-4.6.5-11.el7.centos.3.x86_64 389-ds-base-1.3.9.1-10.el7.x86_64 pki-ca-10.5.16-5.el7_7.noarch krb5-server-1.15.1-37.el7_7.2.x86_64
We are dying need of this feature. So we are requesting earnestly to add this feature.
In code, what we are trying is given in here-
https://stackoverflow.com/questions/59374179/password-is-expired-just-after-user-is-added-to-freeipa
I'm going to close this ticket as WONTFIX because this is by design, as described at the page you referenced.
If you need to keep initial passwords for the users, you may want to amend your procedure to create those passwords like described in this email: https://www.redhat.com/archives/freeipa-users/2012-June/msg00360.html
Please do not open issues in upstream for questions that are better handled in freeipa-users@ mailing list, https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/.
Metadata Update from @abbra: - Issue close_status updated to: wontfix - Issue status updated to: Closed (was: Open)