[keycloak-user] Keycloak LDAP federation (FreeIPA) and expired passwords

Hello, We're trying to use Keycloak as the main portal for users (to access services + manage their accounts) - but I've been struggling to come up with the best solution for handling expired passwords (for federated users - FreeIPA LDAP). We are using Keycloak (3.4.3). As far as I am aware, expired passwords are currently only handled correctly with Active Directory (using the msad-user-account-control mapper). It looks like someone was interested in implementing for other LDAP providers, but didn't: https://issues.jboss.org/browse/KEYCLOAK-4052 I've also tried configuring keycloak to use Kerberos password authentication (LDAP + Kerberos integration..) - but that still didn't seem to detect the expired password (even though from a console, kinit prompts the user to change their password). So, currently I have put in a workaround by: 1. Under the realm Authentication - Required Actions - set "Update Password" to default (so "new" users - ie: those who are given a temp password - are prompted to set a new password... keycloak has been given access to set non-expired passwords on our FreeIPA servers) 2. Set a password policy on the realm - 90 days expiry (matches that of the FreeIPA password policy). Some issues with this are - if the user sets their password via FreeIPA directly (kpasswd, ldap, etc) - then keycloak won't know about the new expiry - hence, the user may have to set their password again on Keycloak sooner than they would expect. So, my questions are: 1. Is there a better way to handle this? We'd just like to avoid sending our users around to different places (ie: to the freeIPA UI) to work around an expired password & we'd like to make sure it's clear _when_ their password has expired... to the best of our ability. 2. I'm also not 100% certain if this Keycloak password policy is actually implemented on federated ldap users? Does anyone know? I came across a few issues that discussed implementing it - but so far haven't come up with anything conclusive (I'm setting the password expiry to 1 day now to test it out). I checked a dump of the database, and could not see anything that looked like a timestamp or anything (to indicate a 90 day expiry) for a user who just changed their password in Keycloak... so, I'm not sure how that's tracked? (if I could find it in the DB, I was thinking of another dirty hack to sync the password expiry from freeipa -> keycloak via a hook if someone does update their account in freeipa). Thanks, Ryan