Don't permit login if password is expiring

[Cantor, Scott]

> Is there a way to block login if password is expiring?

You can do a post-login interceptor as one possible method, or you can hook into the Password login flow itself via the authn/conditions framework that can wire in behavior during the login sequence in response to classified events.

If you force somebody to change their password, then all you've done is actually expire it. It's no longer "expiring" but "expired". Why not just do whatever you would do in the latter case?

-- Scott