Can't unlock screen with last day password (before expired)

[Aleksey Vazhnov]

[Impact]

When I login with last day password, all ok. But when I locked screen, I can't unlock it, receive error «Invalid password, please try again».
I think, this bug more globally — «unity-panel-service --lockscreen-mode» does not have function for changing user password.

[Test case]
How to reproduce:

You need working LDAP-server and Ubuntu with LDAP client. My client, Ubuntu 14.04:

cat <<EOF |
ldap-auth-config ldap-auth-config/dblogin boolean false
ldap-auth-config ldap-auth-config/dbrootlogin boolean false
ldap-auth-config ldap-auth-config/ldapns/ldap-server string ldap://ldap/
ldap-auth-config ldap-auth-config/ldapns/ldap_version select 3
ldap-auth-config ldap-auth-config/move-to-debconf boolean true
ldap-auth-config ldap-auth-config/ldapns/base-dn string dc=example,dc=com
nslcd nslcd/ldap-base string dc=example,dc=com
nslcd nslcd/ldap-uris string ldap://ldap/
libnss-ldapd libnss-ldapd/nsswitch multiselect group, passwd, shadow
EOF
debconf_answers_ldap.dat

sudo debconf-set-selections debconf_answers_ldap.dat
sudo apt-get install libnss-ldapd libpam-ldap nss-updatedb libnss-db libpam-ccreds nscd libpam-cracklib

And create file /usr/share/pam-configs/mkhomedir:

Name: activate mkhomedir
Default: yes
Priority: 900
Session-Type: Additional
Session:
 required pam_mkhomedir.so umask=0022 skel=/etc/skel

Then run:
sudo pam-auth-update

Count todays number:
echo $(($(date --utc --date "$1" +%s)/86400))
For example, 16587.
In LDAP, add user account with attribute shadowMax=10 and shadowLastChange=16577.
Try to login in Ubuntu. All ok. No errors, no messages.
Now lock the screen (Ctrl+Alt+L).
Try to unlock screen — you can't. You see error «Invalid password, please try again».

Workaround:
Login to guest account and change user to myself.

[Regression potential]

Lock might fail

[Andrea Azzarone (azzar1)]

Added to Trello: https://trello.com/c/KV7ozI62/13-bug-1460649-can-t-unlock-screen-with-last-day-password-before-expired

[Launchpad Janitor (janitor)]

This bug was fixed in the package unity - 7.5.0+16.10.20160628.1-0ubuntu1

---------------
unity (7.5.0+16.10.20160628.1-0ubuntu1) yakkety; urgency=medium

  [ Andrea Azzarone ]
  * UnitySettings: Add an option to enable/disable pam account checking.
    (LP: #1460649)
  * Lockscreen: Make sure warning and errors are properly shown to the
    user (LP: #1593696)

 -- Marco Trevisan (Treviño) <[e-mail]> Tue, 28 Jun 2016 16:23:47 +0000

[Brian Murray (brian-murray)]

Hello Aleksey, or anyone else affected,

Accepted unity into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/unity/7.4.0+16.04.20160705-0ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Steve Langasek (vorlon)]

Hello Aleksey, or anyone else affected,

Accepted unity into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/unity/7.4.0+16.04.20160715-0ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Launchpad Janitor (janitor)]

This bug was fixed in the package unity - 7.4.0+16.04.20160715-0ubuntu1

---------------
unity (7.4.0+16.04.20160715-0ubuntu1) xenial; urgency=medium

  [ Eleni Maria Stea ]
  * PanelView: Don't draw it if the geo doesn't intersect the monitor
    geo (as in ezoom)
  * speeds up the showdesktop plugin in lowgfx mode

  [ Andrea Azzarone ]
  * Add whitelist for auto-repated keys. (LP: #1586491)
  * Fix scale window activation if in show desktop mode. (LP: #1582056)
  * Order matters in the rendering. Draw launcher shadow after the
    background in all cases. (LP: #1586374)
  * Fallback to volume name if no other identifier is available. (LP:
    #1103593)
  * Do not trigger screensaver on session inactive. (LP: #1587507)
  * Use SwitcherController::SetDetail instead of detail=... (LP:
    #1587618)
  * UnitySettings: Add an option to enable/disable pam account checking.
    (LP: #1460649)
  * Lockscreen: Make sure warning and errors are properly shown to the
    user (LP: #1593696)
  * Add missing header to fix compilation error with -Duse_pch=OFF.
  * Filter out fullscreen window in show desktop mode. (LP: #1597706)
  * Make sure file manager icon is not removed when unpinned. (LP:
    #1578792)
  * Properly calculate the intersection geometry in PanelView::Draw.
    This is needed to properly call SyncGeometries and to avoid problems
    such as lp:1595698. (LP: #1595698)

  [ Alberto Milone ]
  * UnitySettings: Add dconf keys for disabling multitouch gestures (LP:
    #1589520)

  [ Marco Trevisan (Treviño) ]
  * LockScreenAcceleratorController: use key::Grabber to handle allowed
    bindings (LP: #1438754)
  * LockScreenAcceleratorController: check if a setting key is available
    instead of crashing
  * ApplicationLauncherIcon: ensure quirks are properly set on icon
    initialization
  * Views: Toggle animators durations based on low-gfx setting (LP:
    #1598770)
  * unity7.conf: use different compiz profile based on
    unity_support_test result (LP: #1598770)

 -- Marco Trevisan (Treviño) <[e-mail]> Fri, 15 Jul 2016 10:14:41 +0000

[Adam Conrad (adconrad)]

The verification of the Stable Release Update for unity has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.