Dovecot auth_cache behavior during password expiration

Answer – Does the cache bypass expiration?

In Dovecot 2.3 and newer, the auth_cache stores a successful authentication result keyed by the user’s mailbox name (and optionally the client IP). While an entry is still within its auth_cache_ttl, the authentication pipeline skips the pass‑database entirely. Consequently, any expiration flag returned by the passdb is ignored until the cached entry expires.

Is there an automatic cache invalidation on password expiration?

There is no built‑in option that automatically flushes the cache when a password is marked expired or revoked by the passdb. The only automatic control is the TTL you set in auth_cache_ttl. If you need immediate revocation, you must clear the cache yourself.

Manual cache invalidation

Dovecot provides the doveadm utility for this purpose. The command to flush the cache for a specific user is:

# Flush the cache for a single user
sudo doveadm auth cache flush [contact removed]

# Flush the cache for all users (use with caution)
sudo doveadm auth cache flush

After executing the command, the next authentication attempt for that user will hit the passdb and honor the expiration flag.

Practical verification steps

1. Check your Dovecot version:

   dovecot -v
   

   Make sure you are running 2.3.x or later.

2. Verify the passdb plugin you use (e.g., passdb_sql, passdb_ldap, passdb_file) by inspecting /etc/dovecot/dovecot.conf or running:

   doveadm -n | grep -i passdb
   

3. Authenticate a test user to create a cache entry.
4. Mark the password as expired in your passdb (the exact method depends on the plugin).
5. Attempt to log in again – you should still succeed because the cache is still valid.
6. Run the doveadm auth cache flush command for that user.
7. Try to log in once more – the authentication should now fail, reflecting the expiration.

What if your passdb supports change notifications?

Some passdb plugins (e.g., LDAP) can notify Dovecot of attribute changes via a change‑notification mechanism, but this feature is not used to trigger an automatic auth‑cache flush. Therefore, even with change notifications, you still need to clear the cache manually if you want the expiration to take effect immediately.

Summary

Cached credentials bypass password‑expiration checks until the TTL lapses. Dovecot does not provide an automatic cache flush on expiration; the reliable method is to run doveadm auth cache flush for the affected user(s). After that, the next authentication will consult the passdb and enforce the expiration flag.