Enforce password change every 90 days (3 months)

Question

I am currently building an intranet for a client and one of their requirements is that staff must update their passwords every 90 days.

I assume I would need to build a plugin for this, but what would be best to way to approach this? I was hoping it might work whereby this was set 90 days after the last password change, rather than a fixed date for every user.

Thanks

Answer 1

$date90DaysAgo = (new \DateTime())->modify('90 days ago')->format('Y-m-d H:i:s');
foreach(\craft\elements\User::find()->lastPasswordChangeDate('<='.$date90DaysAgo)->all() as $user){
    Craft::$app->getUsers()->sendPasswordResetEmail($user);
    $user->newPassword = // generate some temp password, so the user can't login with his/her anymore
    $user->setScenario(User::SCENARIO_PASSWORD);
    Craft::$app->getElements()->saveElement($user);
}

get the date 90 days ago, find all users where lastPasswordChangeDate is smaller than this date, send them a new password reset email and change their password to something else, so they can't login anymore.