Since the change to the new authentication system, everyone is required to change their password every 60? 90? days.
This is an outmoded security practice that actually leads to more risk of accounts being exposed: https://www.sans.org/blog/time-for-password-expiration-to-die/
If LODS will not consider turning this off for all, I would like the ability to turn it off for my organization.
| Who would most benefit from this idea? | LMS Administrators or LMS Learners |
To add to this, I see 828 logins, all since Feb 15, with "Unknown" as the authentication method. I suspect these should all be "Local Account". Is it possible that accounts with the "Unknown" authentication method are getting flagged for password expiration by LODS?
No, I have logged into this account many times since the switchover (28, to be exact, from Feb 23 onwards).
Since the switchover, the authentication method for this account says "Unknown" instead of "Local Account". I noticed this was also the case for the other account where someone reported having to change their password recently – just since the switchover, the authentication method for all their logins is "Unknown".
This was the first time logging in with this account since the change over? If so, that is expected. All accounts required a 1 time password reset due to the shift in data storage location and naturally for security purposes passwords are encrypted in such a way that migrations in services like that are unable to maintain the same password.
This should not occur more than that first time though.
This was for a local account (my test student account). Looking at the sign-in history for that account, the authentication method is shown as "Local Account" until sometime between Feb 9 and Feb 23, when the authentication method changes to "Unknown". The authentication provider is blank for all sign-ins.
I don't remember exactly what the message was, just that I tried to log in on the new login page using the username and password fields and couldn't because my password had expired.
The new authentication system should have no password expiry for "Local" accounts. However if you are utilizing federated SSO access (Azure AD, Microsoft Account, Google Account, etc.) these settings are configured at the organization or personal account level of those systems.
Can you please confirm which method you are using? And if possible an example of what is being seen when this occurs?