"Token has been expired" in Sulu remember-me authentication without built-in credential expiration management

Direct answer

Assuming a recent Sulu release that delegates authentication to Symfony Security, Sulu treats remember-me token expiration as a framework-level session concern, not a password-lifecycle feature. The "Token has been expired" exception is raised by Symfony's remember-me service when the persistent cookie exceeds its configured lifetime. Sulu propagates this unchanged because it does not own the remember-me token store or its TTL policy. Core Sulu also does not ship password-age enforcement or an administrative interface for listing, warning about, or resetting expired credentials.

Confirmed behavior vs. project assumptions

Confirmed behavior: Symfony's remember-me implementation validates the token's expiry timestamp on each auto-login attempt. When the timestamp is in the past, it raises an AuthenticationException with the message "Token has been expired". Sulu's sulu_user provider and sulu_security role hierarchy sit downstream of this check; they do not intercept or reinterpret the exception.

Likely architectural boundary: Sulu focuses on content access control and role management. Session persistence, cookie lifetime, and token rotation belong to the Symfony firewall configuration. Password-age policies, credential auditing, and remediation are intentionally left to the integrator because they vary by compliance regime and deployment.

What integrators should implement

Treat Symfony remember-me expiration as a session-persistence signal only. It does not indicate that a user's password is too old. If your least-privilege deployment requires password rotation, you must implement it explicitly:

1. Add a passwordUpdatedAt (or equivalent) field to your user entity.
2. Implement a Symfony UserCheckerInterface or an authentication event listener that blocks login when the password age exceeds your policy.
3. Emit and handle the optional sulu_user.password_expired event if you want Sulu-aware hooks, but do not expect core Sulu to enforce the policy automatically.

Auditing and remediation without a built-in UI

Because Sulu provides no admin screen for credential state, audit directly at the data layer:

• Remember-me tokens: Query the configured remember-me token storage table for rows where the expiry column is in the past.
• Password age: Query your user table for accounts whose passwordUpdatedAt predates your compliance window.
• Remediation: Delete expired tokens to force re-authentication. For password expiry, trigger a reset flow or disable the account via your custom checker.

Verification steps

Confirm the remember-me lifetime in config/packages/security.yaml under the remember_me key. Use the Symfony Profiler's Security tab during a failing request to verify that the exception originates from the remember-me service, not from a Sulu voter or provider. Test with a token whose TTL has elapsed to confirm propagation.

One diagnostic question

Are you required to enforce password rotation by policy, or only clean up stale remember-me cookies? The answer determines whether you need a custom UserChecker and user-entity changes, or simply a scheduled cleanup of the token table.