Hello,
We are using OKTA on some sites for the external authentication provider. We just had some of our users get locked out due to their password expirying (expires=true was appended to the URL). However, they have been active on the site so it shouldn't lock them out.
The problem was that AccessUser.AccessUserPasswordDate was still at a date from 90 days ago when their account was created. The password policy is for 90 day.
It appears that AccessuserPasswordDate isn't updated when someone logs in through an external provider. However, I would take it a step further and say that external logins should skip the check for their password expiring, so that the external login provider is used instead.
The code to do that is in LogOnHandler. You can search for &expires=true to find the section where this is occuring. Skipping that check there should give this a good solution.
Would you agree? In the meantime I've reset the PasswordDate to today's date which buys me 3 months.
Thanks!
Scott
