freeipa

#9823 Passwords migrated from 3rd-party LDAP are tagged as expired on first login
Closed: invalid by abbra. Opened by woprandi.

Closed: invalid
Reopen Issue

Issue

I'm experimenting a FreeIPA migration from OpenLDAP. I use ipa migrate-ds to import data to IPA. I linked a Keycloak instance. User can now logs in. But on first login, some Kerberos attributes are added to user's LDAP entry (krb*). And krbPasswordExpiration is set to now.
Since FreeIPA is referenced as LDAP and no Kerberos in Keycloak, no problem.
But when user logs in on an enrolled laptop. He has to change his password. Does this behavior is customizable ?

Steps to Reproduce

  1. Import users from 3rd party LDAP
  2. Enroll a host
  3. Login

Actual behavior

Users has to update their password

Expected behavior

No need to users to update their password

Version/Release/Distribution

FreeIPA 4.12.2

This is not a bug but an intentional behavior in FreeIPA. See https://www.freeipa.org/page/New_Passwords_Expired.

For any other questions related to migration, please use freeipa-users@ mailing list instead of opening individual bugs here. This issue tracker is not a help for operation problems.

Metadata Update from @abbra:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)

@abbra This page explains why an initial password set by an administrator is immediatly set as expired. It does not fit into the case I am specifying.

Please provide SSSD logs that show what happens. A login to on enrolled system will cause a password change for the first time a user logs in via Kerberos after somebody did change a password for the user.

You have not described how you did your Keycloak integration. If that is purely LDAP bind, then Keycloak doesn't actually have support for changing passwords if LDAP bind returns a hint to do so because the password has been marked expired. It means it was not really changed yet.

In any case, I do not see this as an issue in IPA. Please provide more details about your configuration and log files through freeipa-users@ mailing list.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.