Enquiry on Password Expiry and Change Period

[Purushotham]

Description:

I have queries on Password profile This has to do with the settings “Required Password Change Period (days)”. We created a password profile to test this setting and to avoid affecting the rest of the users. We set this setting to 3 (days). We then created a testuser and applied the password profile to this testuser and commit. After 3 days, instead of being prompted to change the password, the testuser account is locked out. According to the description here https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-web-interface-help/device/device-password-profi..., we are supposed to be prompted to change password, not get locked out. After checking around, I see from this post https://live.paloaltonetworks.com/t5/general-topics/panorama-administrators-user-required-password-c... that it has been documented previously, but no solution was posted there.

[JayGolf]

Hi @Purushotham ,

For the test accounts, did you create using local database auth? If so, you cannot assign password profiles to administrative accounts that use local database authentication (see Device > Local User Database > Users). If you try it with a user assigned a auth profile of SAML/LDAP/RADIUS/ETC. it should work. 

[Purushotham]

Hi,

CX did not create using local database auth.

[OtakarKlier]

Hello,

I have yet to see Palo Alto implement a prompt for an admin user for a password expiration. I have a calendar reminder to do it.

Regards,