How can Forgejo be configured to enforce least-privilege authentication while rejecting expired credentials?

Question

When running a Forgejo instance that authenticates users against an external LDAP directory, administrators often aim to apply the principle of least privilege by granting only the permissions required for each role. At the same time, they need to ensure that user accounts whose LDAP passwords have expired are not allowed to log in, even if the account still exists in the directory. The Forgejo documentation mentions support for LDAP synchronization and authentication filters, but it is unclear whether expired credentials can be automatically rejected without manual intervention. How can Forgejo be configured to enforce least‑privilege access while automatically blocking login attempts that use expired LDAP credentials, and what configuration options or hooks are available to achieve this behavior?

Tasadduq Burney · Answer

Forgejo least‑privilege authentication and expired credential rejection

When Forgejo integrates with an external LDAP directory, administrators can apply least‑privilege principles by restricting user and application token scopes through the admin panel or API. Repository permissions, issue creation, and other repository‑level actions are limited to the minimum required for each role.

Expired credential handling differs by authentication path. For local accounts, the ACCOUNT_PASSWORD_EXPIRE_DAYS setting in custom/conf/app.ini enforces a password lifetime; logins are rejected once the interval elapses without a reset. For LDAP‑integrated users, Forgejo does not independently verify password expiry; access is governed by the external directory’s bind response. Enabling REQUIRE_PASSWORD_CHANGE_ON_FIRST_LOGIN can force a password reset on next login, but its effect with LDAP depends on whether the directory propagates expiry status during bind.

Least‑privilege configuration steps

In Site Admin → Users, adjust repository and organization permissions to the minimum required for each role.
Create personal access tokens with scoped capabilities (e.g., read:repo) and verify that write operations are denied, confirming scope restriction.

Expired credential configuration steps

Set ACCOUNT_PASSWORD_EXPIRE_DAYS = 90 in custom/conf/app.ini if managing local accounts.
Enable REQUIRE_PASSWORD_CHANGE_ON_FIRST_LOGIN to prompt a reset on first login after creation or policy change.
For LDAP users, confirm the directory’s password‑policy mechanism (e.g., Active Directory pwdLastSet, OpenLDAP shadow expiry) and how Forgejo’s LDAP bind interacts with it.

Diagnostic question: Does your LDAP directory return password expiry information during the bind phase, and is Forgejo configured to honor bind‑based password status?

How can Forgejo be configured to enforce least-privilege authentication while rejecting expired credentials?

1 answer

Forgejo least‑privilege authentication and expired credential rejection

Least‑privilege configuration steps

Expired credential configuration steps

Your perspective belongs here.

1 question comment

Verification Steps