Didn't realize it was GMT, so OK that's not the issue. Any suggestions on how to debug it? Everything looks OK, but passwords are just perma-expired at all times. <div class="gmail_quote"><div dir="ltr">On Tue, Oct 27, 2015, 21:45 Rob Crittenden <<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">urgrue wrote: > Hi, > On a new install, I'm being forced a password reset on every login. Not > sure why but this doesn't look right: > > # date > Tue Oct 27 21:02:57 CET 2015 > > # ipa user-status blah1 > <snip> > Last successful authentication: 2015-10-27T19:34:53Z > Last failed authentication: 2015-10-27T19:34:20Z > Time now: 2015-10-27T20:03:00Z > > Where is it getting this wrong time from? What's wrong with the time? CET is one hour behind GMT right? That is reflected by the difference between the output of date and "Time now". Passwords administratively reset must be set by the user during the first authentication. If the password needs further reset then yeah, something is wrong, but the above looks ok. rob </blockquote></div>