Issue

I set up a web SSO which uses LDAP to authenticate users. This portal is named LemonLDAP::NG
This portal also let users manage their password (updating and resting throught dedicated service account).
This portal is able to retrive attributes needed for password expiration check.

It seems that FreeIPA uses krbPasswordExpiration to store password expiration.
However LDAP password control requests use attribute "passwordExpirationTime" to return password state.

Password updates throught Kreberos seems not to update LDAP password expiration date (attribute passwordExpirationTime).

I think for passwordPolicyControl to work, attribute "passwordExpirationTime" should be synchronized with "krbPasswordExpiration".

Is there a way to set sync between these attributes? or Does this need some developement?

Steps to Reproduce

1. create account throught FreeIPA web UI
2. create needed items to allow ssh login on a server managed by freeipa
3. log via ssh into a freeipa managed server with root login
4. enable passwordPolicyControl in LDAP
5. set krbPasswordExpiration to an expired date for previously created account
6. check account expiration throught LDAP request 'ldapsearch -e ppolicy'
7. test ssh login with previously created account

Actual behavior

last ssh auth attempt start password renewal procedure

Expected behavior

ldapsearch search should show "expired password"

Version/Release/Distribution

$ cat /etc/centos-release
CentOS Linux release 8.4.2105

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.9.2-4.module_el8.4.0+846+96522ed7.x86_64
ipa-client-4.9.2-4.module_el8.4.0+846+96522ed7.x86_64
389-ds-base-1.4.3.16-19.module_el8.4.0+884+e9b25896.x86_64
pki-ca-10.10.5-3.module_el8.4.0+816+beb6e9a3.noarch
krb5-server-1.18.2-8.el8.x86_64

Additional info:

N/A