ns8-samba: Maximum password age of 1000 days fails, Samba only accepts 0-999

[stephdl]

Steps to reproduce

• Go to NS8 admin UI → domain configuration → Edit password policy
• Enable password expiration
• Set Maximum password age to 1000
• Save

Expected behavior
The change is applied, or a clear error is shown before any command runs.

Actual behavior
set-password-policy aborts with exit code 255:

$ podman exec samba-dc samba-tool domain passwordsettings set --max-pwd-age=1000
ERROR: Maximum password age must be in the range of 0 to 999!

The UI slider for Maximum password age (ns8-core, EditPasswordPolicy.vue) has a hardcoded max="1000", but Samba's AD-style password policy only accepts 0-999. ns8-samba's set-password-policy action (50set_password_policy) passes the value straight to samba-tool with no validation.

Workaround: use 999 instead of 1000, it applies immediately.

Components

• ns8-samba

Note: ns8-openldap does not share this limit — pwdMaxAge there is a plain seconds-based integer with no AD-style 999-day cap, so no equivalent fix is needed on that side.

[DavidePrincipi]

@stephdl please do not set the BUG label, use the issue type instead.

[stephdl]

QA

Target: ghcr.io/nethserver/samba:3.4.9-dev.1

1. Test Password policy
   Test the original issue is no longer reproducible.

• Set Maximum password age to 1000 days.
• No error is reported and the value is correctly limited to 999 days.

2. User and group management
   Test basic user and group operations:

• Create a user
• Create a group
• Add the user to the group
• Delete the user
• Delete the group

All operations must complete successfully.