fails if user home directory is kerberized and password change is forced

Our home directories are on a file system requiring Kerberos to access. Normal login is with sssd.

In the usual case, auth pam_sss checks the user's static password and creates a Kerberos ticket. pam_google is able to read the user's home directory because the user has a Kerberos ticket. Everything works as usual.

But suppose the user forgets their password. We set a temporary password which is expired. pam_sss in auth phase returns new_authtok_reqd, as it is supposed to. Because the login hasn't actually succeeded, there is now no Kerberos ticket for the user.

What is supposed to happen is that pam_sss in the account phase changes the password and creates a Kerberos ticket. However pam_google, in the auth phase get errno 13 (no permission) when trying to read the user's google auth information, and fails the login. This can be fixed in the pam configuration, but doing so requires a pretty much inscrutable config file.

Suggestion: treat errno 13 like file not found, at least as an option. The only way a user would not have permission to their own directory is some weird condition like this.