Troubleshooting: SecureAuth Reports a Password as Expired When It Isn't

Version Affected: All
 
 

Overview

When logging in, users are told their password has expired, even though it hasn't.

Cause

Inline Password Change is disabled, but Password Expires Days is set to fewer days than the Active Directory password policy allows. SecureAuth ends up treating the password as expired before AD does, and since Inline Password Change is off, users never get the chance to reset it within SecureAuth and get locked out.

Resolution:

Adjust the realm's password expiration setting to match (or exceed) the AD password policy:

1. Open the Admin Console and go to the realm's Workflow tab.
2. Scroll to the Password Settings section and click Password Rules and Policy Settings.

3. Under Password Expiration, either blank out Password Expires Days, or set it to a value that matches your environment's actual AD password policy, rather than a shorter one.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.