Just to confirm, the user's are resetting their password on their own selfservice page, right?

This problem is temporarily fixed in this patch:

• master: b73fc6e
• ipa-2-2: afa1ab9

Previously the self-service page calls the passwd command without including the username in the argument. The username is supposed to be optional but the command sometimes doesn't work without it. This problem is not always reproducible, so it's rather difficult to investigate. The above patch modifies the self-service page to include the username in the command argument to avoid the problem until we can figure out the real cause of the problem.

Proposing to close the ticket. Above patch and the one in #2067 produce good messages. I didn't manage to reproduce the issue.

Password change tests in self-service page:

- wrong current password test: "Insufficient access: Invalid credentials"
- min. lifetime test: "Constraint violation: Too soon to change password"
- length test: "Constraint violation: Password is too short"
- character classes test: "Constraint violation: Password is too simple"
- history test: "Constraint violation: Password reuse not permitted"

See #2067 for more details.

Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=802786