SSSD Offline Credentials vs LDAP Password Expiration Enforcement in RHEL 9

Authentication Behavior with Expired LDAP Passwords

RHEL 9's default authentication stack uses SSSD as the primary backend for LDAP/AD integration, with pam_sss.so delegating authentication to SSSD. The pam_unix.so module handles local password expiration checks, but when LDAP passwords expire, the system's behavior depends on SSSD's cache configuration.

The key constraint is ensuring that expired LDAP credentials are rejected immediately during authentication, rather than being accepted through SSSD's offline cache mechanism. This becomes critical in environments where password policies mandate immediate enforcement of expiration dates across all authentication methods.

Two documented approaches exist: configuring SSSD to disable offline credentials entirely, or adjusting cache expiration timeouts to align with LDAP password policies. The unresolved decision centers on which approach provides proper balance between authentication reliability and security enforcement when LDAP servers are unavailable.

Which SSSD configuration approach—disabling offline credentials or synchronizing cache expiration with LDAP password policies—correctly enforces expired LDAP password rejection while maintaining acceptable authentication availability during network outages?