modX Revo password expiry and least-privilege authentication transition

Expected behavior when a password expires

In the standard modX Revo login flow, the login_password_expiry setting is evaluated by the core login processor (modUser::login() or the Login processor) before any Access Policy or User Group permissions are checked. Therefore, if a user’s password age exceeds the configured interval, the system redirects to the password‑change screen regardless of how restrictive the user’s least‑privilege Access Policy is.

Confirmed facts

• The expiry check occurs in the core login processor and is independent of resource or context access rules.
• Least‑privilege configurations that limit access via Access Policies are applied only after the login processor has decided to allow the login or to prompt for a password change.
• If a custom authentication plugin replaces or bypasses the core login processor and does not invoke the expiry check, the prompt can be suppressed, allowing login under the user’s policy.

Steps to verify the behavior for your environment

1. Set the system setting login_password_expiry to a low value (e.g., 0 days) for testing.
2. Log out, then log in with a test user that has a highly restrictive Access Policy.
3. Observe whether the password‑change screen appears before any resource is rendered.
4. Repeat the test with all custom authentication plugins disabled; if the prompt still appears, the core behavior is confirmed; if it disappears, a plugin is interfering.
5. Optionally inspect core/model/modx/moduser.class.php (the login() method) or the Login processor to confirm the expiry check precedes any policy evaluation.

If you observe that the expiry prompt is bypassed despite the core check being present, please provide details of any custom login or authentication plugins you are using, as that information would change the recommendation.