Properties 'Password:' and 'Password-Initial:' are intentionally removed
from /usr/share/pam-configs/yourdev because changing a remote password
from the host using standard commands does not work in the Orange
environment : it changes the password in the Active Directory backend,
but not in the Gassi backend (they are not synchronized), and you end
up with two active passwords: the new one for kinit, IMAP, SMTP, SMB,
etc. and the old one for all websites from MonSI ...
With this configuration, you must use first the 'mot de passe attitude'
website to change your AD/Gassi password, and then the command `passwd`
to synchronize your local password.
With default priority (128), pam-auth-update put module pam_sss after
module pam_unix in /etc/pam.d/common-auth, and then a user with a
local account and local password synchronized with AD password will
never be granted a Kerberos TGT on session opening.
