You could expire the account, and not the password. Not the most elegant way, but I could not find any other way to implement password expiry. I did try it a while back on a much older version, so I can't  tell if latest code still supports it. All I needed to have in OpenLDAP is shadowExpire and no other "shadow" attributes. sssd.conf [pam] .... pam_verbosity = 1 pam_pwd_expiration_warning = 21 pam_account_expired_message = Your LDAP password has expired, please use selfservice portal to change your LDAP password .... [domain/xyz] .... # SET Account expiration to shadowAccount ldap_account_expire_policy = shadow ldap_user_shadow_expire    = shadowExpire # shadowExpire: days since Jan 1, 1970 that account is disabled: $ echo $(($(date --utc --date "$1" +%s)/86400)) # SET Password expiration to none ldap_pwd_policy = none ldap_access_order = filter, expire .... On 10/31/18 10:26 AM, Bartłomiej Solarz-Niesłuchowski wrote: