How can Forgejo be configured to enforce least-privilege authentication while rejecting expired credentials?
When running a Forgejo instance that authenticates users against an external LDAP directory, administrators often aim to apply the principle of least privilege by granting only the permissions required for each role. At the same time, they need to ensure that user accounts whose LDAP passwords have expired are not allowed to log in, even if the account still