Does TYPO3 automatically revoke backend sessions when a user's password expires?

Session Persistence After Password Expiry

TYPO3's password_policy system extension (since v10) enforces maximum password age, history, and complexity rules for backend users. However, the interaction between password expiration and existing authenticated sessions appears underspecified in the documentation.

Observed Behavior Gap

When a backend user's password reaches its configured expiry date, the AuthenticationService chain validates credentials before checking expiration status. This means a user with an expired password can still authenticate if their session cookie remains valid. The session lifetime is governed by sessionTimeout in LocalConfiguration.php, which defaults to several hours and can be extended.

Constraints and Uncertainty

• No built-in mechanism revokes active sessions upon password expiry; invalidation requires explicit logout, admin action, or natural session timeout.
• Third-party authentication services (LDAP, SAML, OIDC) may bypass local password policies entirely, creating inconsistent enforcement.
• Multi-factor authentication (v11+) adds a second factor but does not reset or clear the password expiration flag after a successful MFA challenge.

Administrators needing immediate revocation must implement custom scheduler tasks or middleware, but the core behavior for native authentication remains unclear.

Which configuration options or extension points allow automatic session invalidation when a backend user's password expires? Does the core provide any event or hook triggered at the moment of password expiry that could initiate revocation? How do third-party authentication services integrate with the local password expiration state to prevent policy bypass?