<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_1_1441813211101_3150"><br></div><div id="yui_3_16_0_1_1441813211101_3186">Hi,</div><div id="yui_3_16_0_1_1441813211101_3192"><br></div><div id="yui_3_16_0_1_1441813211101_3275">We have set a password policy to have passwords expire after a number of days. This works fine through the Keycloak login screen. However, when we use the REST API to do a direct grant (we call '/protocol/openid-connect/token' on Keycloack 1.3.1) a valid token is returned even after the password has expired.</div><div id="yui_3_16_0_1_1441813211101_3366"><br></div><div id="yui_3_16_0_1_1441813211101_3367">This does not seem like the correct behavior. Is there an issue here?</div><div id="yui_3_16_0_1_1441813211101_3380"><br></div><div id="yui_3_16_0_1_1441813211101_3381">Thanks,</div><div id="yui_3_16_0_1_1441813211101_3382">Chris</div><div id="yui_3_16_0_1_1441813211101_3383"><br></div><div id="yui_3_16_0_1_1441813211101_3288"><br></div><div id="yui_3_16_0_1_1441813211101_3313"><br></div></div></body></html>