Expired passwords stuck

It seems like the requirement to enter the old password is actually coming from Drupal core. The expired passwords issue is Password Policy I'm sure, but I wonder what the connection is. Can you repeat the behavior without Password Policy and see what happens?

I have the same issue as @jbsc97 above.

Tried upgrading to version 1.0 and the problem persists. FYI, the error message about the password being expired does not appear for the user in question when the Password Policy module is disabled.

I was only able to correct the issue for the user by going into the "password_policy_expiration" database table and deleting the row that referred to the user id (uid) in question.

Looks like the error message is triggered by the "password_policy_init()" function, but I'm guessing it should be the responsibility of a different function to properly clear out the database record of the expiration once the password has been successfully changed by either an admin or the user himself/herself.

This is the relevant code. Lines 286-298 in password_policy.module -

  // If the current user is being forced to change their password and is
  // changing their password, toggle the force_change field off.
  if (isset($account->force_password_change) && $account->force_password_change && ($account->pass != $account->original->pass) && $user->uid == $account->uid) {
    db_update('password_policy_force_change')
      ->fields(array(
        'force_change' => 0,
      ))
      ->condition('uid', $account->uid)
      ->execute();
    db_delete('password_policy_expiration')
      ->condition('uid', $account->uid)
      ->execute();     
  }

Looking at the code above... Could this problem be created then if the user changed the password to the same as the original password? That would cause the if statement above to return false and the record wouldn't be deleted.

I agree. In addition that seems like a scenario we should be catching and raising an error on. Would you mind checking to make sure this scenario is the cause of the problem?

Confirmed. This issue appears to happen if the following conditions are met:

• Password expiration is set to something other than 0 (let's call this "n" days)
• The user's password expires after "n" days have passed
• The user "changes" the password to the exact same password that was originally in place when the module was installed

The problem appears to be that the "password_policy_history" table is generally checked to make sure that a password is not being repeated. However, if the user does not initially have a historical password saved in that table, then the "if" statement shown in comment #5 above is never executed, the "password_policy_expiration" database table row for the user is not deleted during a password change, and the account becomes stuck as a permanently expired account.

Note: It looks like the "Blocking expired accounts" setting must be initially set to "Expired accounts are blocked. Only administrators can unblock them." too.

I think all we need to check for is whether the user submitted a password with the account update. I've simplified the condition to account for this.

http://drupalcode.org/project/password_policy.git/commit/7b02bdb