I installed the following Openldap version on Centos 7 Server:

ldapsearch: @(#) $OpenLDAP: ldapsearch 2.4.40 (Mar 31 2016 15:24:47) $
    (LDAP library: OpenLDAP 20440)

My Client is Centos 7 too.

Everything is working properly less one thing, when "ShadowLastChange" is set to "0" to force expiring the password.

I am prompted change the password and the password is changed and the ShadowLastChange is changed as well but when I try to login again I am prompted change the password on every login:

You are required to change your password immediately (password aged)
password expired 16560 days ago
Last login: Thu Sep 15 22:14:19 2016 
WARNING: Your password has expired.
You must change your password now and login again!
Changing password for user test.ldap.
(current) LDAP Password: 
New password:

I read the following link related to this:


My shadowLastChange attribute on nis.schema is alright:

attributetype ( NAME 'shadowLastChange'
        EQUALITY integerMatch

Also, my shadowLAstChanged attribute is changed by changing password but still prompting change password on every login.

Can anybody point me in the right direction?



Same on ubuntu 16.04. Workaround - I added the line to /etc/ldap.conf.

nss_default_attribute_value  shadowLastChange 20000

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.