JHipster generated RBAC least-privilege and credential expiration diagnosis

JHipster scaffolds Spring Security with authorities and roles derived from the generated user management domain, supporting role based access control for least privilege. Authentication type is selected at generation time, typically JWT stateless or OAuth2 OIDC session based, which determines token issuance and validation behavior in the generated backend.

The generated user entity and security configuration do not include password expiration, rotation enforcement or credential age checks by default. In JWT based setups the generated backend is stateless by default, so token revocation and immediate invalidation on credential change require design beyond the scaffold. JHipster generates URL security and method security annotations but does not prescribe a consistent enforcement scope.

Clarification is needed on default credential lifecycle handling and where least privilege enforcement is intended to be applied in a generated application.

Does the generated backend provide any default checks for expired credentials or password age, and where would such checks be added in the scaffold? For JWT versus OIDC generation, how does the scaffold handle token invalidation after a credential change? Is least privilege enforcement intended to be applied at the web layer, service layer, or both?