=== modified file 'dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/user/DefaultUserService.java'
--- dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/user/DefaultUserService.java	2013-12-18 15:08:00 +0000
+++ dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/user/DefaultUserService.java	2013-12-18 15:28:59 +0000
@@ -36,6 +36,7 @@
 import org.hisp.dhis.period.PeriodType;
 import org.hisp.dhis.setting.SystemSettingManager;
 import org.hisp.dhis.system.filter.UserCredentialsCanUpdateFilter;
+import org.hisp.dhis.system.util.DateUtils;
 import org.hisp.dhis.system.util.Filter;
 import org.hisp.dhis.system.util.FilterUtils;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -608,13 +609,15 @@
     @Override
     public boolean credentialsNonExpired( UserCredentials credentials )
     {
-        Integer credentialsExpires = systemSettingManager.credentialsExpires();
+        int credentialsExpires = systemSettingManager.credentialsExpires();
 
-        if ( credentialsExpires == null || credentialsExpires == 0 )
+        if ( credentialsExpires == 0 )
         {
             return true;
         }
+    
+        int months = DateUtils.monthsBetween( credentials.getPasswordLastUpdated(), new Date() );
 
-        return true;
+        return months < credentialsExpires;
     }
 }

=== modified file 'dhis-2/dhis-support/dhis-support-system/src/main/java/org/hisp/dhis/system/util/DateUtils.java'
--- dhis-2/dhis-support/dhis-support-system/src/main/java/org/hisp/dhis/system/util/DateUtils.java	2013-09-16 17:07:25 +0000
+++ dhis-2/dhis-support/dhis-support-system/src/main/java/org/hisp/dhis/system/util/DateUtils.java	2013-12-18 15:28:59 +0000
@@ -43,6 +43,7 @@
 import org.hisp.dhis.period.PeriodType;
 import org.joda.time.DateTime;
 import org.joda.time.Days;
+import org.joda.time.Months;
 
 /**
  * @author Lars Helge Overland
@@ -306,6 +307,22 @@
     }
 
     /**
+     * Calculates the number of months between the start and end-date. Note this
+     * method is taking daylight saving time into account and has a performance
+     * overhead.
+     *
+     * @param startDate the start date.
+     * @param endDate the end date.
+     * @return the number of months between the start and end date.
+     */
+    public static int monthsBetween( Date startDate, Date endDate )
+    {
+        final Months days = Months.monthsBetween( new DateTime( startDate ), new DateTime( endDate ) );
+
+        return days.getMonths();
+    }
+
+    /**
      * Calculates the number of days between Epoch and the given date.
      * 
      * @param date the date.

=== modified file 'dhis-2/dhis-web/dhis-web-commons/src/main/resources/META-INF/dhis/security.xml'
--- dhis-2/dhis-web/dhis-web-commons/src/main/resources/META-INF/dhis/security.xml	2013-12-18 14:27:32 +0000
+++ dhis-2/dhis-web/dhis-web-commons/src/main/resources/META-INF/dhis/security.xml	2013-12-18 15:28:59 +0000
@@ -48,8 +48,7 @@
     class="org.springframework.security.web.authentication.ExceptionMappingAuthenticationFailureHandler">
     <property name="exceptionMappings">
       <props>
-        <prop key="org.springframework.security.authentication.CredentialsExpiredException">/dhis-web-commons/security/login.action?expired1=true</prop>
-        <prop key="org.springframework.security.authentication.AccountExpiredException">/dhis-web-commons/security/login.action?expired2=true</prop>
+        <prop key="org.springframework.security.authentication.CredentialsExpiredException">/dhis-web-commons/security/login.action?expired=true</prop>
       </props>
     </property>
     <property name="defaultFailureUrl" value="/dhis-web-commons/security/login.action?failed=true" />