topic Re: Enquiry on Password Expiry and Change Period in General Topics

Enquiry on Password Expiry and Change Period

Purushotham — Mon, 26 Aug 2024 06:57:49 GMT

Description:

I have queries on Password profile This has to do with the settings “Required Password Change Period (days)”. We created a password profile to test this setting and to avoid affecting the rest of the users. We set this setting to 3 (days). We then created a testuser and applied the password profile to this testuser and commit. After 3 days, instead of being prompted to change the password, the testuser account is locked out. According to the description here https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-web-interface-help/device/device-password-profiles, we are supposed to be prompted to change password, not get locked out. After checking around, I see from this post https://live.paloaltonetworks.com/t5/general-topics/panorama-administrators-user-required-password-change-period/td-p/517991 that it has been documented previously, but no solution was posted there.

Re: Enquiry on Password Expiry and Change Period

JayGolf — Mon, 26 Aug 2024 11:54:08 GMT

Hi @Purushotham ,

For the test accounts, did you create using local database auth? If so, you cannot assign password profiles to administrative accounts that use local database authentication (see Device > Local User Database > Users). If you try it with a user assigned a auth profile of SAML/LDAP/RADIUS/ETC. it should work.

Re: Enquiry on Password Expiry and Change Period

Purushotham — Tue, 10 Sep 2024 02:50:23 GMT

Hi,

CX did not create using local database auth.

Re: Enquiry on Password Expiry and Change Period

OtakarKlier — Tue, 10 Sep 2024 18:30:46 GMT

Hello,

I have yet to see Palo Alto implement a prompt for an admin user for a password expiration. I have a calendar reminder to do it.

Regards,