I have created posix group and posix account also able to successfully authenticate client but client unable to change the password. The error is password change failed: Confidentiality required``passwd: Authentication token manipulation error./var/log/secureAug 23 05:08:13 RHELQA passwd: pam_ldap(passwd:chauthtok): password change failed: password change failed: Confidentiality required; user=johanpAug 23 05:08:34 RHELQA passwd: pam_unix(passwd:chauthtok): user johanp does not exist in /etc/passwdAug 23 05:09:11 RHELQA passwd: pam_unix(passwd:chauthtok): user johanp does not exist in /etc/passwdAug 23 05:09:11 RHELQA passwd: pam_ldap(passwd:chauthtok): password change failed: password change failed: Confidentiality required; user=johanp Aug 23 05:10:29 RHELQA passwd: pam_unix(passwd:chauthtok): user johanp does not exist in /etc/passwdAug 23 05:10:40 RHELQA passwd: pam_unix(passwd:chauthtok): user johanp does not exist in /etc/passwdAug 23 05:10:40 RHELQA passwd: pam_ldap(passwd:chauthtok): password change failed: password change failed: Confidentiality required; user=johanpAug 23 06:28:28 RHELQA sshd[3224]: Accepted publickey for ec2-user from x.x.x.x port 5466 ssh2: RSA SHA256:OqK/b0ailCh32//NbcWAgGtzZK35fOVuvqY0xtnNIPIAug 23 06:28:28 RHELQA sshd[3224]: pam_unix(sshd:session): session opened for user ec2-user by (uid=0)Aug 23 06:28:30 RHELQA sudo: ec2-user : TTY=pts/2 ; PWD=/home/ec2-user ; USER=root ; COMMAND=/bin/bashAug 23 06:29:07 RHELQA sshd[3257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.x.x.x  user=johanpAug 23 06:29:07 RHELQA sshd[3257]: Accepted password for johanp from x.x.x.x port 5474 ssh2Aug 23 06:29:07 RHELQA sshd[3257]: pam_unix(sshd:session): session opened for user johanp by (uid=0)Aug 23 06:29:12 RHELQA passwd: pam_unix(passwd:chauthtok): user johanp does not exist in /etc/passwdAug 23 06:29:23 RHELQA passwd: pam_unix(passwd:chauthtok): user johanp does not exist in /etc/passwdAug 23 06:29:23 RHELQA passwd: pam_ldap(passwd:chauthtok): password change failed: password change failed: Confidentiality required; user=johanp/etc/pam.d/system-auth#%PAM-1.0# This file is auto-generated.# User changes will be destroyed the next time authconfig is run.auth        required      pam_env.soauth        required      pam_faildelay.so delay=2000000auth        sufficient    pam_unix.so nullok try_first_passauth        requisite     pam_succeed_if.so uid >= 1000 quiet_successauth        sufficient    pam_ldap.so use_first_passauth        required      pam_deny.soaccount     required      pam_unix.so broken_shadowaccount     sufficient    pam_localuser.soaccount     sufficient    pam_succeed_if.so uid < 1000 quietaccount     [default=bad success=ok user_unknown=ignore] pam_ldap.soaccount     required      pam_permit.sopassword    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtokpassword    sufficient    pam_ldap.so use_authtokpassword    required      pam_deny.sosession     optional      pam_keyinit.so revokesession     required      pam_limits.so-session     optional      pam_systemd.sosession     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uidsession     required      pam_unix.sosession     optional      pam_ldap.so/etc/pam.d/password-auth#%PAM-1.0# This file is auto-generated.# User changes will be destroyed the next time authconfig is run.auth        required      pam_env.soauth        required      pam_faildelay.so delay=2000000auth        sufficient    pam_unix.so nullok try_first_passauth        requisite     pam_succeed_if.so uid >= 1000 quiet_successauth        sufficient    pam_ldap.so use_first_passauth        required      pam_deny.soaccount     required      pam_unix.so broken_shadowaccount     sufficient    pam_localuser.soaccount     sufficient    pam_succeed_if.so uid < 1000 quietaccount     [default=bad success=ok user_unknown=ignore] pam_ldap.soaccount     required      pam_permit.sopassword    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtokpassword    sufficient    pam_ldap.so use_authtokpassword    required      pam_deny.sosession     optional      pam_keyinit.so revokesession     required      pam_limits.so-session     optional      pam_systemd.sosession     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uidsession     required      pam_unix.sosession     optional      pam_ldap.so/etc/openldap/ldap.conf## LDAP Defaults## See ldap.conf(5) for details# This file should be world readable but not world writable.#BASE   dc=example,dc=com#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666#SIZELIMIT      12#TIMELIMIT      15#DEREF          neverTLS_CACERTDIR /etc/openldap/cacerts# Turning this off breaks GSSAPI used with krb5 when rdns = falseSASL_NOCANON    onURI ldap://backup.abc.xyz.local/BASE dc=abc,dc=xyz,dc=local
389 ldap client authentication issue [CENTOS 7]
linux;group;ldap;useradd