When authenticating a user for login, if a new password is required,
pam_authenticate should return PAM_SUCCESS, and pam_acct_mgmt should return
PAM_NEW_AUTHTOK_REQD.

However, pam_winbind returns PAM_NEW_AUTHTOK_REQD for pam_authenticate, making
it impossible for a user to login against a Windows DC if they must change their
password on their next login.

The following patch appears to fix this:
--- samba/source/nsswitch/pam_winbind.c 2003-06-07 11:57:34.000000000 -0600
+++ samba.mine/source/nsswitch/pam_winbind.c    2004-07-12 15:19:17.000000000 -0600
@@ -454,7 +454,24 @@
      }

      /* Now use the username to look up password */
-     return winbind_auth_request(username, password, ctrl);
+     retval = winbind_auth_request(username, password, ctrl);
+
+     static char buf[256] = {0};
+     sprintf(buf, "%d", retval);
+     if(pam_set_data(pamh, "winbind_auth_retval", buf, NULL) != PAM_SUCCESS) {
+        _pam_log(LOG_WARNING, "pam_sm_authenticate return code %d cannot be
saved for pam_sm_acct_mgmt", retval);
+        return PAM_BAD_ITEM;
+     }
+     switch (retval) {
+        case PAM_AUTHTOK_EXPIRED:
+           _pam_log(LOG_WARNING, "pam_sm_authenticate would return
PAM_AUTHTOK_EXPIRED, returning PAM_SUCCESS instead", retval);
+           return PAM_SUCCESS;
+       case PAM_NEW_AUTHTOK_REQD:
+           _pam_log(LOG_WARNING, "pam_sm_authenticate would return
PAM_NEW_AUTHTOK_REQD, returning PAM_SUCCESS instead", retval);
+           return PAM_SUCCESS;
+        default:
+           return retval;
+     }
 }

 PAM_EXTERN
@@ -503,7 +520,7 @@
        case 0:




            /* Otherwise, the authentication looked good */
            _pam_log(LOG_NOTICE, "user '%s' granted acces", username);
-           return PAM_SUCCESS;
+           break;
        default:
            /* we don't know anything about this return value */
            _pam_log(LOG_ERR, "internal module error (retval = %d, user = `%s'",
@@ -511,6 +528,24 @@
            return PAM_SERVICE_ERR;
     }

+    char *ptr = NULL;
+    if( pam_get_data(pamh, "winbind_auth_retval", (const void **)&ptr) !=
PAM_SUCCESS ) {
+       _pam_log(LOG_WARNING, "pam_sm_acct_mgmt cannot retrieve
pam_sm_authenticate return value", retval);
+       return retval;
+    }
+
+    retval = atoi( ptr );
+    switch (retval) {
+       case PAM_AUTHTOK_EXPIRED:
+          _pam_log(LOG_WARNING, "pam_sm_acct_mgmt returning
PAM_AUTHTOK_EXPIRED", retval);
+          return retval;
+       case PAM_NEW_AUTHTOK_REQD:
+          _pam_log(LOG_WARNING, "pam_sm_acct_mgmt returning
PAM_NEW_AUTHTOK_REQD", retval);
+          return retval;
+       default:
+         return PAM_SUCCESS;
+    }
+
     /* should not be reached */
     return PAM_IGNORE;
 }