Force password change (PAMAuthenticator)

JupyterHub
,
1

Hi,

I’m trying to achieve the following action : users registered in Jupytherhub must change their password every 6 months.

To ensure this, I thought that using the PAMAuthenticator authenticator class might help, and define password expiration policy with cgage (chage --lastday 0 my_admin to test it). However, I get an error message and can’t change password (except if I log in in ssh, but users will use the web interface so I want to trigger the password change workflow from the login form if needed) :

jupyterhub  | [W 2025-05-22 10:17:30.321 JupyterHub auth:1402] PAM Authentication failed (my_admin@::ffff:172.19.0.1): [PAM Error 12] Authentication token is no longer valid; new one required

Is it possible to trigger a password change in jupytherhub ? Should I use another authenticator class to achieve this ?

Thanks !

2

This is not possible with PAMAuthenticator and AFAIK there none of the officially supported JupyterHub authenticators support password expiration policy. There is NativeAuthenticator where users can change their password via web browser but it does not enforce the expiration policy.