SEC-2999: Support users with expired credentials being authenticated with limited access

Ben Kiefer (Migrated from SEC-2999) said:

Quick bit of background...

We've got a need to force a password change after a user logs in with expired credentials. The change password endpoint should require the user to be authenticated.

We are using an InMemory configuration for local development and the ActiveDirectory based provider for CI and beyond. By default, expired credentials result in an exception that prevents a user from being authenticated.

In the past, I've done this by adding a role to the user during authentication after detecting that their credentials are expired, and then redirecting them to the appropriate page for password changes. I can then lock down the change password endpoints with that specific role, and remove it when they finish up.

I've not typically been dealing with two authentication mechanisms (in memory/AD), but now that I am, I was wondering if you had any thoughts on adding support for an expired credentials handler that defaults to throwing the CredentialsExpiredException. This could be customized similarly to how the authentication success handler is during security configuration.

If there is a better way to do this that I'm unaware of, I'd love a pointer. Thank you!

No files or tests are named. Start by reviewing how the in-memory and Active Directory providers handle expired credentials and how authentication success handlers are configured; define the desired handler behavior and its interaction with authenticated, limited-access users. Done means the proposed behavior is specified for both providers while the default still throws CredentialsExpiredException.