Local verification error?

[Fwatson]

I've recently got Jamf Connect up and running in our educational institution's lab machines, and while it's working smoothly logging in with Google IDP for the most part I've had a few encounters now with a mysterious error when students are logging into machines they already have a pre-existing local account on.

The users' network password authenticates fine, but then instead of logging in it puts up a password box which just says "Verify", and while I'm aware that this is meant to be because the users' network and local accounts are out of sync and it needs the old local account password to verify the users' identity, the verify password box rejects everything ... old passwords and new. It leaves the user completely unable to login to the device.

I've experienced this today with a student who logged into that device completely fine on Friday, and has come back on Monday morning to find this happening on the device. Neither the network or local password have changed over the weekend, so I'm baffled as to why the student is receiving a Verify request. This has happened to a few students now over the opening couple of weeks of the term.

Has anyone else experienced anything like this? Is there something super obvious I'm missing?

[ycssolomonzheng]

I am having the same problem with exactly one machine. Out of the blue it happened.

[Fwatson]

I found the reason for the issue for me, and it was that the user's Google idP password contained their name, which was completely fine for Google but I believe violates macOS password policy? I've not tested it but I've assumed that macOS is not ok with the password for a local account containing the name of that local account.

Once the user started using a password that did not contain their name the issue resolved.