Re: [keycloak-user] Password Expiration not applied to Token
The direct grant shouldn't return any tokens if there are required actions so this is
a bug. Can you create a bug report please?
----- Original Message -----
From: "Chris Atkinson" <atgnatus(a)yahoo.com>
To: keycloak-user(a)lists.jboss.org
Sent: Wednesday, 9 September, 2015 5:54:02 PM
Subject: [keycloak-user] Password Expiration not applied to Token
Hi,
We have set a password policy to have passwords expire after a number of
days. This works fine through the Keycloak login screen. However, when we
use the REST API to do a direct grant (we call
'/protocol/openid-connect/token' on Keycloack 1.3.1) a valid token is
returned even after the password has expired.
This does not seem like the correct behavior. Is there an issue here?
Thanks,
Chris
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user