Livio Spring 7eb3bd5e78 fix(login v1): only check password expiry for local users with password (#11344) ...

# Which Problems Are Solved

When setting a password expiry policy, users without password, e.g.
federated users, would be prompted to change their password. This was
due to two bugs, where the policy would be applied for all users.
Additionally, whenever a user was created a `PasswordChanged` timestamp
would be set, regardless if the user has a password or not.

# How the Problems Are Solved

- Only apply the password expiry check on local authentication and users
with a password (e.g. passkey only users would not be prompted)
- Only set the `PasswordChanged` timestamp for users with password

# Additional Changes

None

# Additional Context

- reported through Discord:
https://discord.com/channels/927474939156643850/1447235781717397596/1450481990808637470
- requires backport to v4.x

(cherry picked from commit c79267a9e6)

2026-01-23 11:24:54 +01:00

..

model

feat: Add recovery code MFA support (#9954)

2026-01-06 10:54:41 +01:00

repository

fix(login v1): only check password expiry for local users with password (#11344)

2026-01-23 11:24:54 +01:00