Users with Active Directory expired passwords can still log in

Users with Active Directory expired passwords can still log in

by Luis Guerra -
Number of replies: 3

Hello,

We have our University Moodle users authenticate through Active Directory, but we have a strange behavior:
When a user password expires, they can still log in to Moodle (apparently indefinitely).

We have the following pertaining settings in Moodle:

Prevent password caching - Yes

Expiry - LDAP server

Grace logins - No


What are we doing wrong, or is there another way for Moodle to cache user's passwords?


Thanks,

Luis Guerra

Average of ratings: -
In reply to Luis Guerra

Re: Users with Active Directory expired passwords can still log in

by Emma Richardson -
Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Plugin developers

That is definitely not how mine works.  When passwords expire, they cannot login.  I would suspect that maybe it is a setting in AD that is allowing them to still use the existing password.

In reply to Emma Richardson

Re: Users with Active Directory expired passwords can still log in

by Luis Guerra -

No, Moodle is the only application with this behavior. All other applications we have integrated, work as intended.

Besides, users also can't log in on a domain computer, so it's not any AD setting...

This is not a recent event, this has been going on with our Moodle installation for many versions now. Can't even remember when it started. I've tried many times to solve this, but to no success. I've read about all possible caching being done by all modules involved, but I've yet to figure out where the caching is being made (if at all...).

In reply to Luis Guerra

Re: Users with Active Directory expired passwords can still log in

by Visvanath Ratnaweera -
Picture of Particularly helpful Moodlers Picture of Translators
You mean only the users, whose password has expired, can still log in, not those whose password has been changed in the AD? They login with the new password?