From d89eea147d2d91f6c2399ca2d029ad9c91acf2c6 Mon Sep 17 00:00:00 2001
From: Michel Decima <michel.decima@orange.com>
Date: Mon, 1 Nov 2021 18:58:30 +0100
Subject: [PATCH] feat: disable chpass provider in SSSD configuration

Using the "change password" feature of pam_sss modules always lead to a
bad situation where AD password and Gassi password are not synchronyzed
anymore. To avoid this, we disable the feature in SSSD configuration.

The network password can still be changed using the command `kpasswd`
provided by package `krb5-user`.
---
 etc/sssd/sssd.conf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/etc/sssd/sssd.conf b/etc/sssd/sssd.conf
index 1047f0d..3fade44 100644
--- a/etc/sssd/sssd.conf
+++ b/etc/sssd/sssd.conf
@@ -26,6 +26,7 @@ debug_level = 9
 min_id = 1000
 id_provider = files
 auth_provider = krb5
+chpass_provider = none
 cache_credentials = true
 use_fully_qualified_names = false
 krb5_realm = AD.FRANCETELECOM.FR