Password Expiry Controls

[julianlam]

For security purposes (and @tedr56, you may feel the same), it may be advantageous to set a system-wide password policy in order to force users to reset their password after a certain number of days.

The real reason I suggest this is so automated setups can set a random password (or no password at all), followed by an enforced password reset upon initial login.

[julianlam]

Tasks

• User password reset should automatically log you in after changing it Impossible to do
• New passwordExpiry unix timestamp, default is 0 (unless password policy dictates otherwise)
• On login:
  • If passwordExpiry !== 0 and < current time, generate reset code and redirect user to that page

[teotikalki]

I was just about to file a feature request for the ability to set password expiration/ flag an account such that the user must change their password at next login.
I can't currently find the expiration functionality (running 1.10.2) and do not see mention of the 'change password at next login' at all. Should I file a new Issue for this?

[julianlam]

@teotikalki We have these options exposed under Settings -> User: