IdM allows LDAP bind with expired password

Issue

• How to configure IdM LDAP server (389-ds) to disallow binding/authenticating using expired password?

• The user's password has expired

  # ipa user-show bob --raw --all
    dn: uid=bob,cn=users,cn=accounts,dc=example,dc=com
    uid: bob
    givenname: Bob
    sn: User
    cn: Bob User
    <...>
    krbPasswordExpiration: 20240814004456Z     <<<<<=====
  

• However, the user is allowed to perform LDAP bind and authenticate successfully without any warning:

  ldapsearch -v -x -H ldap://server1.example.com -D "uid=bob,cn=users,cn=accounts,dc=example,dc=com" -W -b "uid=bob,cn=users,cn=accounts,dc=example,dc=com"