SSSD offline authentication permits login with expired backend passwords

Background

AlmaLinux 8 and 9 ship SSSD 2.8.x as the default service for centralized authentication against LDAP, Active Directory, or FreeIPA. SSSD caches password hashes locally to support offline login; the cache lifetime is governed by offline_credentials_expiration (default 0, meaning unlimited). When a user's password expires in the backend directory, SSSD does not automatically invalidate the cached hash until the next successful online authentication or an explicit cache purge.

Goal and constraints

The objective is to enforce least-privilege access so that expired backend credentials cannot be used for local authentication while preserving offline login capability for valid credentials. Current mitigations include reducing offline_credentials_expiration to a short interval or setting cache_credentials = false, but the former only narrows the exposure window and the latter disables offline login entirely. The pam_sss module performs no backend expiration check during offline authentication—it only verifies the supplied password against the cached hash.

Open questions

1. Does SSSD 2.8.x provide any mechanism to validate backend password expiration status during offline authentication without a full online round-trip?
2. What are the practical trade-offs of setting offline_credentials_expiration to a low value versus disabling cache_credentials entirely for environments requiring strict least-privilege enforcement?
3. Are there planned upstream changes to introduce a lightweight backend probe for password expiration during offline auth, and what is the expected backport timeline for AlmaLinux 9?