Didn't realize it was GMT, so OK that's not the issue. Any suggestions on how to debug it? Everything looks OK, but passwords are just perma-expired at all times.
> On a new install, I'm being forced a password reset on every login. Not
> sure why but this doesn't look right:
> # date
> Tue Oct 27 21:02:57 CET 2015
> # ipa user-status blah1
> Last successful authentication: 2015-10-27T19:34:53Z
> Last failed authentication: 2015-10-27T19:34:20Z
> Time now: 2015-10-27T20:03:00Z
> Where is it getting this wrong time from?
What's wrong with the time? CET is one hour behind GMT right? That is
reflected by the difference between the output of date and "Time now".
Passwords administratively reset must be set by the user during the
first authentication. If the password needs further reset then yeah,
something is wrong, but the above looks ok.