title: Forcing user to change expired password in spring security
body: <p>I am building spring mvc and spring security based web based application.</p>
  
  <p>I have implemented Reset Password functionality.System Administrator will reset password of any user .Random generated password will be emailed to user and same will be updated in database.</p>
  
  <p>Now I want whenever user login with random generated password, i want to force user to change its password.</p>
  
  <p>Please have a look to my <strong>user</strong> TABLE.</p>
  
  <p>userid                 bigint(20)<br>
  username               varchar(20)<br>
  password               varchar(65)<br>
  email                  varchar(50)<br>
  firstname              varchar(20)<br>
  lastname               varchar(20)<br>
  groupname              varchar(50)<br>
  enabled                tinyint(1)<br>
  credentialsNonExpired  tinyint(1) </p>
  
  <p><strong>MY Authentication Provider</strong>
  
      </p>
  
  <pre><code>    &lt;!--
          Configuring Authentication Provider to make use of spring security
          provided Jdbc user management service
      --&gt;
      &lt;authentication-provider user-service-ref="jdbcUserService"&gt;
          &lt;!--
              Configuring SHA-1 Password Encoding scheme to secure user credential
          --&gt;
          &lt;password-encoder ref="sha1PasswordEncoder" /&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  </code></pre>
  
  <p>I have used <strong>JDBCUserDetailsService</strong> extending <strong>JDBCDaoImpl</strong> as <strong>jdbcUserService</strong>.</p>
  
  <p>I want to set <strong>credentialNonExpired</strong> to false column of my user table when I am resetting password.</p>
  
  <p>I am able to do that.</p>
  
  <p>But when i login, spring security <strong>JDBCuserdetailsservice loadUserbyUsername</strong> getting only username,password,enabled columns and rest of all fields set to true.</p>
  
  <pre><code>protected List&lt;UserDetails&gt; loadUsersByUsername(String username) {
      return getJdbcTemplate().query(usersByUsernameQuery, new String[] {username}, new RowMapper&lt;UserDetails&gt;() {
          public UserDetails mapRow(ResultSet rs, int rowNum) throws SQLException {
              String username = rs.getString(1);
              String password = rs.getString(2);
              boolean enabled = rs.getBoolean(3);
              return new User(username, password, enabled, true, true, true, AuthorityUtils.NO_AUTHORITIES);
          }
  
      });
  }
  </code></pre>
  
  <p>But I want actual <strong>credentialNonExpired</strong> field which is set by reset password, so that spring security will throw CREDENTIALEXPIREDEXCEPTION.</p>
  
  <p>I am achieving that by loading above method, but is there any other way to redirect user to change password page when they login with expired password.</p>
  
  <p>Please tell me how can i do that ?</p>