[Samba] Samba AD/DC, Single-Sign-On, domain users cannot change password

[Viktor Trojanovic]

I haven't had this use-case myself yet as I only connected Win clients so far but I remember reading here on the list that this functionality is not built-in for Unix, you either need to script it yourself or resort to third party tools. I think there are some FLOSS tools around that allow the user to change their password via an internally hosted web page. Search the list (and web) using those keywords, you should find enough results.

Viktor

> On 14 Jan 2016, at 06:54, Mark Foley <mfoley at ohprs.org> wrote:
> 
> Hmmm, this message is a week old and nothing?
> 
> I know many of you have domain member hosts in your domain and surely are logging in as domain
> users authenticating with the Samba4 AD/DC, right?
> 
> How do you change your password without having the domain Administrator do it for you?
> 
> --Mark
> 
> -----Original Message-----
> From: Mark Foley <mfoley at ohprs.org>
> Date: Fri, 08 Jan 2016 12:10:16 -0500
> To: samba at lists.samba.org
> Subject: [Samba] Samba AD/DC, Single-Sign-On,
>    domain users cannot change password
> 
> I have successfully joined my Linux/Ubuntu workstation to the Samaba AD/DC domain thanks to
> help from Rowland Penny.
> 
> Now I face an interesting problem ... Domain users cannot change their password.
> 
> Domain users can successfully login to the Linux workstation using their domain credentials,
> but when the user tries to change the password using "Passwords and Keys" from the desktop
> utility, it does nothing.
> 
> Trying to change the password from a terminal session using `passwd` gives the prompt: "Current
> Kerberos password:" but entering the current domain password is not accepted and the prompt repeats.
> 
> If the Domain Administrator set the user's account to "User must change password at next
> login", or if the domain policy expires passwords after so-many days, the user cannot log into
> the Linux workstations -- the display manager login dialog spins for several minutes, then
> shows, "Invalid password, please try again."
> 
> This is serious. How does a domain user change his own password? 
> 
> HELP!
> 
> --Mark
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba