<div dir="ltr"><div class="gmail_extra">I'm sorry, I do not know what question you are answering. I never mentioned wanting password changes propagated to anything. In fact, these accounts are normally created with no valid password at all on the local machine. That's what I want: user attempts to login, system checks with AD to verify credentials, and then home dir shell etc is pulled from the the local user account.<br>
<br><div class="gmail_quote">On Sat, Jun 7, 2014 at 10:20 AM, Jim Kinney <span dir="ltr"><<a href="mailto:jim.kinney@gmail.com" target="_blank">jim.kinney@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<p dir="ltr">Hmm. As much as it pains me to say this, sssd can use AD as the master auth process. Unless AD admin provides an access id with write ability, password changes will have to occur on AD and then propagate to IPA.</p>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>James Sumners<br><a href="http://james.roomfullofmirrors.com/">http://james.roomfullofmirrors.com/</a><br><br>"All governments suffer a recurring problem: Power attracts pathological personalities. It is not that power corrupts but that it is magnetic to the corruptible. Such people have a tendency to become drunk on violence, a condition to which they are quickly addicted."<br>
<br>Missionaria Protectiva, Text QIV (decto)<br>CH:D 5</div></div>