What happens to active sessions when an end user's password is expired?

When an end user's password expires, their active sessions typically remain active until the user attempts to log in again. This means that the user can continue using the services and applications they are currently authenticated in without being forced to log out immediately. The system allows for this continuity so that users are not abruptly interrupted in their work or tasks. It also provides a window for the user to change their password at their convenience during this period.

The process ensures that users have a chance to update their credentials without experiencing immediate disruption, promoting a smoother transition and enhancing user experience. Once the user attempts a new session or tries to re-authenticate after their password has expired, that is when they will be prompted to change their password and will likely be logged out of existing active sessions.