SSSD offline authentication permits login with expired backend passwords

Answer SSSD 2.8.x does not validate backend password expiration during offline authentication; the pam_sss module only compares the supplied password against the cached hash. Confirmed facts - Offline credentials are stored in the SSSD cache and remain usable until offline_credentials_expiration expires or the cache is cleared. - The default value of offline_credentials_expiration is 0 (unlimited). - Setting cache_credentials = false disables all caching, forcing every login to contact the LDAP/AD/IPA server, which enforces expiration immediately. - Reducing offline_credentials_expiration to a non‑zero value limits the window where an expired password can be used, but does not eliminate it. Likely explanation The SSSD offline path is designed for speed and resilience; it deliberately avoids extra LDAP round‑trips. Consequently, password‑expiration controls that live in the directory are not consulted until an online bind succeeds. Steps to enforce least‑privilege while preserving offline login 1. Check the current setting: grep -i offline_credentials_expiration /etc/sssd/sssd.conf 2. If the value is 0 (or absent), choose a short interval that matches your security policy, e.g., one hour: offline_credentials_expiration = 3600 3. Restart SSSD to apply: systemctl restart sssd 4. Verify that after the interval elapses (or after sssd_cache -E) an offline login with an expired password fails and prompts for online authentication. When disabling the cache may be preferable If any user absolutely must never be able to log in with an expired password, and offline login is not required for any workload, set: [domain/...] cache_credentials = false Then restart SSSD. This removes the exposure window entirely but also eliminates offline login for all users. Missing diagnostic detail Confirm whether any system or user truly needs offline login capability. If the answer is “no”, disabling cache_credentials is the simplest mitigation; if offline login is required, proceed with a short offline_credentials_expiration value. Upstream outlook Discussions in the SSSD project have considered a lightweight offline expiration check (e.g., a brief LDAP ping or control) but as of the 2.8.x series no such feature is merged. The earliest expected inclusion is in SSSD 2.9 or 2.10, with possible backports to AlmaLinux 9 in a future point release (e.g., 9.4) if adopted.