90-Days Password Expiration Rule

By default, the admin user password expiry is set to None (no expiry). Starting release r10, a 90-days password expiration rule is set for the OpenStack accounts. The 90-days expiry rule takes effect only after the password is updated. That is, each password change resets the expiry to 90 days.

It is recommended to set --ignore-password-expiry on the admin user immediately after the first password change, so that the account is not subject to the 90-days expiration rule. To explicitly disable the 90-days expiration rule for the admin user, run the following command:

(keystone_admin)]$ openstack user set admin --ignore-password-expiry

Alternatively, you can change the password prior to the 90-days deadline using the standard procedures.

If you have missed the 90-days deadline, follow these steps to regain access:

1. Go to the Horizon web dashboard.

2. Log in using the admin username and the expired password.

   You will be automatically prompted to update your password.

3. Enter your old password and set a new compliant password.

   Once the password is updated via the Horizon UI, CLI access will be automatically restored.