We use ipa-server-4.6.4-10.el7.centos.6.x86_64 and update expiration check script: # userpw_expiry_datetime=$(/usr/bin/ipa user-show ${user} --all | grep krbpasswordexpiration | awk '{print $2}' | cut -c 1-14) userpw_expiry_datetime=$(/usr/bin/ipa user-show ${user} --all | grep -i "password expiration:" | awk '{print $4}' | cut -c 1-14) This is work for me. Regards. Igor S.