Description of problem:
The password cannot be changed for a new IPA user.

Version-Release number of selected component (if applicable):
sssd-1.10.0-1.fc19.alpha1

How reproducible:
always

Steps to Reproduce:
1. Create an user
$ kinit admin
...
$ ipa user-add ipauser --first ipa --last user --password
2. Try to login
$ su - ipauser
Password:
Password expired. Change your password now.
su: Authentication token manipulation error
3./var/log/secure:
Apr 17 13:56:55 f19 su: pam_unix(su-l:auth): authentication failure;
logname=root uid=1000 euid=0 tty=pts/0 ruser=test rhost=  user=aaa
Apr 17 13:56:56 f19 su: pam_sss(su-l:auth): authentication failure;
logname=root uid=1000 euid=0 tty=pts/0 ruser=test rhost= user=aaa
Apr 17 13:56:56 f19 su: pam_sss(su-l:auth): received for user aaa: 12
(Authentication token is no longer valid; new one required)
Apr 17 13:56:56 f19 su: pam_sss(su-l:account): User info message: Password
expired. Change your password now.
Apr 17 13:56:56 f19 su: pam_unix(su-l:chauthtok): user "aaa" does not exist in
/etc/passwd
Apr 17 13:56:56 f19 su: pam_sss(su-l:chauthtok): Authentication failed for user
aaa: 15 (Authentication service cannot retrieve user credentials)



Actual results:


Expected results:


Additional info: