[Freeipa-users] about kpasswd on freeIPA

[Simo Sorce]

On Sat, 17 Jul 2010 09:36:42 +0700
Gugi Gustaman <hyourinseta at gmail.com> wrote:

> I am a newbie with Kerberos and i need help.
> I have a Kerberos installed on my server and it is configured by
> freeIPA. When i make an IPA-user, the kerberos password always
> expires. And then i tried to doing kinit with that user and kerberos
> forced me to change the password because it has expired. And then i
> tried some password to change the expired password but i couldn't and
> kerberos told me that it rejected my new password. After three times
> i tried to change the password, the kinit command finished with error
> message like this "kinit : Password change failed while getting
> initial credentials". I don't know how to solve this problem and I
> need help.
> 
> A week after i made that IPA user, i could doing kinit with that user
> (after kerberos asked for the password and forced me to change the
> password, the password was accepted and i could doing kinit). But
> after I tried to make new IPA user, i met the same problem with the
> problem above (Expired kerberos password). Please help me.
> 
> I am sorry with my English, but I am an Indonesian.

About password expiration on user creation, that is the normal behavior
and here you can read an article that explains the feature:
http://freeipa.org/page/NewPasswordsExpired

For your other problem I am not sure, keep in mind that FreeIPA has a
default password complexity policy that requires you to use a strong
password. If you don't like that you will have to alter and relax the
password policies.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York