LDAP password expiration not triggering forced change in cPanel

Goal: Verify whether password expiration policies defined in an external LDAP/Active Directory source are recognized by cPanel and trigger a forced password change prompt upon the next login for LDAP‑authenticated accounts, while the account remains subject to a least‑privilege Feature Manager profile.

Uncertainty stems from cPanel’s reliance on the underlying Unix PAM stack for authentication; LDAP integrations typically populate local shadow entries via nss_ldap or sssd, but it is not documented whether cPanel consults LDAP‑specific expiry attributes directly or depends on the synchronized shadow file. Additionally, it is unclear if the Feature Manager’s tool‑restriction layer influences the post‑login redirect handling for expired credentials, especially when comparing WHM root access to standard cPanel user sessions.

• Does cPanel check LDAP password expiry attributes during authentication, or does it rely solely on the local /etc/shadow entry?
• If the LDAP password is expired, does cPanel present the standard "Change Password" screen regardless of the assigned Feature List?
• How does the behavior differ between WHM root login and a cPanel user login when LDAP credential expiration occurs?