Add --password-expiration to allow admin to force user password expiration

- Allows an admin to easily force a user to expire their password forcing the user to change it immediately or at a specified time in the future

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>

ipaserver/plugins/baseuser.py

@@ -239,6 +239,10 @@ class baseuser(LDAPObject):
             cli_name='principal_expiration',
             label=_('Kerberos principal expiration'),
         ),
+        DateTime('krbpasswordexpiration?',
+            cli_name='password_expiration',
+            label=_('User password expiration'),
+        ),
         Str('mail*',
             cli_name='email',
             label=_('Email address'),

ipaserver/plugins/user.py

@@ -261,7 +261,7 @@ class user(baseuser):
             ],
             'ipapermdefaultattr': {
                 'krbprincipalkey', 'passwordhistory', 'sambalmpassword',
-                'sambantpassword', 'userpassword'
+                'sambantpassword', 'userpassword', 'krbpasswordexpiration'
             },
             'replaces': [
                 '(target = "ldap:///uid=*,cn=users,cn=accounts,$SUFFIX")(targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword || passwordhistory")(version 3.0;acl "permission:Change a user password";allow (write) groupdn = "ldap:///cn=Change a user password,cn=permissions,cn=pbac,$SUFFIX";)',