Change of password expiration policy defaults

[DavidePrincipi]

An expiring password policy has become obsolete through the years because it generates some of the problems it tries to solve:

• https://www.computerworld.com/article/1722801/microsoft-tells-it-admins-to-nix-obsolete-password-reset-practice.html
• https://learn.microsoft.com/en-us/archive/blogs/secguide/security-baseline-draft-for-windows-10-v1903-and-windows-server-v1903

Proposed solution

• Default password expiration policy: disabled enabled
• If expiry is enabled, Default password age is 0-180
• In UI, when admin sets a password (also in the user creation workflow) add an option "must-change-at-next-login"
• Implement "password-does-not-expire" flag in UI

Additional context

Current password policy settings

Currently Password-does-not-expire is displayed, but not modifiable

See also

Discussion https://mattermost.nethesis.it/nethesis/pl/m93w1ifhgtbqdy8qmmmt7ep3wy

---

Thanks to @nrauso @charliewhiting @digre82