# Ignition Gateway AD Authentication Fails When 'User Must Change Password at Next Logon' is Enabled **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [April 13, 2026, 6:38am UTC](https://forum.inductiveautomation.com/t/ignition-gateway-ad-authentication-fails-when-user-must-change-password-at-next-logon-is-enabled/115034 "2026-04-13T06:38:20Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![mashik](https://avatars.discourse-cdn.com/v4/letter/m/46a35a/32.png) [@mashik](https://forum.inductiveautomation.com/u/mashik)\ **Post date:** [April 13, 2026, 6:38am UTC](https://forum.inductiveautomation.com/t/ignition-gateway-ad-authentication-fails-when-user-must-change-password-at-next-logon-is-enabled/115034/1 "2026-04-13T06:38:20Z")
I created a new user in Active Directory with a temporary password and checked the option **"User must change password at next logon"** during account creation. When the user tries to log in to the **Ignition Gateway (8.1.52)** using the temporary password, authentication fails with no meaningful error. The same credentials work fine on a Windows machine (which prompts for a password change), but Ignition simply rejects the login. **What I've Tried:** - Verified the username and password are correct - Confirmed the user account is not disabled - Confirmed the AD Identity Provider is configured correctly in Ignition (other users without expired passwords log in fine) It seems Ignition's AD Identity Provider does not handle the `password-must-change` challenge. Instead of prompting for a password reset, it treats it as a failed login. **Questions:** 1. Is there a way to handle the password-change challenge within Ignition Gateway? 2. Is there any configuration in the AD Identity Provider settings to support this flow? 3. If not natively supported, what is the recommended approach for onboarding new AD users into Ignition? Any help or workaround is appreciated! ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [April 13, 2026, 1:18pm UTC](https://forum.inductiveautomation.com/t/ignition-gateway-ad-authentication-fails-when-user-must-change-password-at-next-logon-is-enabled/115034/2 "2026-04-13T13:18:59Z")
That's expected behavior. Ignition has no way of setting or changing passwords in AD. The users set up this way will need to first login to a windows PC before logging into Ignition. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [April 13, 2026, 1:46pm UTC](https://forum.inductiveautomation.com/t/ignition-gateway-ad-authentication-fails-when-user-must-change-password-at-next-logon-is-enabled/115034/3 "2026-04-13T13:46:17Z")
1. Don't use a password expiration rule. At all. You must complete onboarding **outside** Ignition. It used to be considered best practice, but has not for many years. After research into the pathological behaviors it inspires in users who struggle to remember new passwords. (And resulting security breaches.) Password expiration is now known to be a **bad** practice. Your IT should be following modern cyber-security guidelines, like those published by the US-CERT division of the Dept. of Homeland Security, or your government's equivalent. ---
**Author:** ![mashik](https://avatars.discourse-cdn.com/v4/letter/m/46a35a/32.png) [@mashik](https://forum.inductiveautomation.com/u/mashik)\ **Post date:** [April 13, 2026, 2:00pm UTC](https://forum.inductiveautomation.com/t/ignition-gateway-ad-authentication-fails-when-user-must-change-password-at-next-logon-is-enabled/115034/4 "2026-04-13T14:00:15Z")
Ok, thankyou for the clarifications ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [April 13, 2026, 4:52pm UTC](https://forum.inductiveautomation.com/t/ignition-gateway-ad-authentication-fails-when-user-must-change-password-at-next-logon-is-enabled/115034/5 "2026-04-13T16:52:33Z")
Had a client company in the last year still enforcing password expiration every 3 months, and I mentioned on a meeting with their cybersecurity team that it is no longer recommended to do that due to this (I've heard stories of many just using the season and year combo to ensure not repeating passwords, so like now would be Spring2026!, and the next one would be Summer2026! because of the fatigue of constantly changing passwords.) They didn't believe me at first but then a few months later I heard they stopped enforcing password changes, so they must have researched it themselves and dropped that policy. ---
**Author:** ![mansourtaheriy4](https://avatars.discourse-cdn.com/v4/letter/m/a183cd/32.png) [@mansourtaheriy4](https://forum.inductiveautomation.com/u/mansourtaheriy4)\ **Post date:** [August 10, 2026, 2:34pm UTC](https://forum.inductiveautomation.com/t/ignition-gateway-ad-authentication-fails-when-user-must-change-password-at-next-logon-is-enabled/115034/6 "2026-08-10T14:34:40Z")
Ignition doesn't natively handle the force password change challenge. Have the user set a permanent password first, then let them log in. ---
**Author:** ![mansourtaheriy4](https://avatars.discourse-cdn.com/v4/letter/m/a183cd/32.png) [@mansourtaheriy4](https://forum.inductiveautomation.com/u/mansourtaheriy4)\ **Post date:** [August 25, 2026, 11:27am UTC](https://forum.inductiveautomation.com/t/ignition-gateway-ad-authentication-fails-when-user-must-change-password-at-next-logon-is-enabled/115034/7 "2026-08-25T11:27:55Z")
I set new AD users' passwords to something random and uncheck the "must change" flag during onboarding. Then they log in fine and can change their password later via Windows. That avoids the authentication failure entirely.