Drupal Core Password Expiration and LDAP Authentication Interoperability

Drupal Core Password Expiration and LDAP Authentication

Goal: Determine whether Drupal core's expiring-passwords enforcement applies to accounts authenticated through an external provider such as LDAP or OAuth, and whether least-privilege role permissions can control password-reset access independently of external login.

Drupal 8, 9, and 10 core include an optional expiring passwords feature in the User module. When enabled, expired passwords normally require an immediate reset before login proceeds. Contrib authentication providers may override or bypass expiration checks, and custom providers may not respect expiration state. It is unclear whether expired-credential state is evaluated before or after external authentication succeeds.

• Does Drupal core enforce password expiration for LDAP- or OAuth-authenticated users before granting access?
• Can a least-privilege role reset its own password without receiving permissions that affect other accounts or external authentication?
• Is expired-credential state shared between core database authentication and external authentication providers?