Dovecot auth_cache behavior during password expiration

Authentication Cache and Credential Validity

Dovecot utilizes auth_cache to store successful authentication results, reducing the load on backend password databases (passdb). This mechanism caches credentials based on the username and IP address for a duration defined by auth_cache_ttl.

In environments implementing strict least-privilege access or frequent credential rotations, there is a potential conflict between the cache TTL and the actual expiration status of a password within the underlying passdb. If a password is marked as expired or revoked in the database, the cache may continue to permit access until the entry expires naturally.

Given the current architecture of the authentication pipeline in Dovecot 2.3+, it is unclear how the system handles the intersection of cached entries and explicit expiration flags returned by a passdb plugin.

• Does the auth_cache bypass the passdb expiration check entirely for the duration of the TTL?
• Is there a mechanism to force a cache invalidation when a passdb reports a credential as expired?