Password expiry
Credential-based accounts can be required to change passwords after a maximum age. Reminder emails are sent by Tasker before expiry; expired accounts must reset their password before signing in again.
Microsoft Entra SSO users are not governed by this password-age policy for their Entra credentials.
What users see
- In-app warnings when a password is approaching expiry.
- Reminder emails with a link based on
NEXTAUTH_URL(must match the public TelWeb URL). - After expiry, login is blocked until the password is changed or reset.
Operator configuration
| Variable | Typical default | Where | Purpose |
|---|---|---|---|
PASSWORD_MAX_AGE_DAYS | 90 | TelWeb + Tasker (must match) | Days before a password must be changed. |
PASSWORD_EXPIRY_WARNING_DAYS | (see env index) | TelWeb + Tasker | Days before expiry when warnings and reminder emails start. |
Tasker runs the PASSWORD_EXPIRY_CHECK schedule, which enqueues NOTIFICATION_SEND for due reminders. See Ops service and the environment variable index.
Reminder emails require a working notification / SMTP path. If users report missing expiry mails, verify Tasker schedules, notification delivery, and that NEXTAUTH_URL matches the environment users reach.
Super Admin password policy
Super Admin accounts also require a longer minimum password length (16 characters). See Regain Super Admin access and Access logs for privileged password and access events.