=== modified file 'dhis-2/dhis-api/src/main/java/org/hisp/dhis/setting/SystemSettingManager.java'
--- dhis-2/dhis-api/src/main/java/org/hisp/dhis/setting/SystemSettingManager.java	2013-11-25 09:51:18 +0000
+++ dhis-2/dhis-api/src/main/java/org/hisp/dhis/setting/SystemSettingManager.java	2013-12-18 15:08:00 +0000
@@ -81,6 +81,7 @@
     final String KEY_ACCOUNT_RECOVERY = "keyAccountRecovery";
     final String KEY_LAST_MONITORING_RUN = "keyLastMonitoringRun";
     final String KEY_GOOGLE_ANALYTICS_UA = "googleAnalyticsUA";
+    final String KEY_CREDENTIALS_EXPIRES = "credentialsExpires";
 
     final String DEFAULT_SCHEDULE_AGGREGATE_QUERY_BUILDER_TASK_STRATEGY = "lastMonth";
     final String DEFAULT_FLAG = "dhis2";
@@ -133,4 +134,6 @@
     boolean emailEnabled();
 
     String googleAnalyticsUA();
+
+    Integer credentialsExpires();
 }

=== modified file 'dhis-2/dhis-api/src/main/java/org/hisp/dhis/user/UserService.java'
--- dhis-2/dhis-api/src/main/java/org/hisp/dhis/user/UserService.java	2013-12-13 16:03:24 +0000
+++ dhis-2/dhis-api/src/main/java/org/hisp/dhis/user/UserService.java	2013-12-18 15:08:00 +0000
@@ -402,4 +402,6 @@
     Collection<String> getUsernames( String query, Integer max );
 
     int countDataSetUserAuthorityGroups( DataSet dataSet );
+
+    boolean credentialsNonExpired( UserCredentials credentials );
 }

=== modified file 'dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/security/DefaultUserDetailsService.java'
--- dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/security/DefaultUserDetailsService.java	2013-12-18 13:58:51 +0000
+++ dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/security/DefaultUserDetailsService.java	2013-12-18 15:08:00 +0000
@@ -28,10 +28,6 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-import java.util.Collection;
-import java.util.HashSet;
-import java.util.Set;
-
 import org.hisp.dhis.user.UserAuthorityGroup;
 import org.hisp.dhis.user.UserCredentials;
 import org.hisp.dhis.user.UserService;
@@ -44,6 +40,10 @@
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
 import org.springframework.transaction.annotation.Transactional;
 
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.Set;
+
 /**
  * @author Torgeir Lorange Ostby
  */
@@ -57,7 +57,7 @@
     // -------------------------------------------------------------------------
 
     private UserService userService;
-    
+
     public void setUserService( UserService userService )
     {
         this.userService = userService;
@@ -78,8 +78,10 @@
             throw new UsernameNotFoundException( "Username does not exist" );
         }
 
+        boolean credentialsExpired = userService.credentialsNonExpired( credentials );
+
         return new User( credentials.getUsername(), credentials.getPassword(),
-            !credentials.isDisabled(), true, true, true, getGrantedAuthorities( credentials ) );
+            !credentials.isDisabled(), true, credentialsExpired, true, getGrantedAuthorities( credentials ) );
     }
 
     // -------------------------------------------------------------------------

=== modified file 'dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/setting/DefaultSystemSettingManager.java'
--- dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/setting/DefaultSystemSettingManager.java	2013-11-25 09:51:18 +0000
+++ dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/setting/DefaultSystemSettingManager.java	2013-12-18 15:08:00 +0000
@@ -172,4 +172,10 @@
     {
         return StringUtils.trimToNull( (String) getSystemSetting( KEY_GOOGLE_ANALYTICS_UA ) );
     }
+
+    @Override
+    public Integer credentialsExpires()
+    {
+        return (Integer) (getSystemSetting( KEY_CREDENTIALS_EXPIRES ) == null ? 0 : getSystemSetting( KEY_CREDENTIALS_EXPIRES ));
+    }
 }

=== modified file 'dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/user/DefaultUserService.java'
--- dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/user/DefaultUserService.java	2013-12-14 13:17:00 +0000
+++ dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/user/DefaultUserService.java	2013-12-18 15:08:00 +0000
@@ -28,26 +28,28 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-import java.io.Serializable;
-import java.util.ArrayList;
-import java.util.Calendar;
-import java.util.Collection;
-import java.util.Date;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.hisp.dhis.common.AuditLogUtil;
 import org.hisp.dhis.dataset.DataSet;
 import org.hisp.dhis.organisationunit.OrganisationUnit;
 import org.hisp.dhis.period.PeriodType;
+import org.hisp.dhis.setting.SystemSettingManager;
 import org.hisp.dhis.system.filter.UserCredentialsCanUpdateFilter;
 import org.hisp.dhis.system.util.Filter;
 import org.hisp.dhis.system.util.FilterUtils;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.transaction.annotation.Transactional;
 
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.Calendar;
+import java.util.Collection;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
 /**
  * @author Chau Thu Tran
  */
@@ -89,6 +91,14 @@
         this.currentUserService = currentUserService;
     }
 
+    private SystemSettingManager systemSettingManager;
+
+    @Autowired
+    public void setSystemSettingManager( SystemSettingManager systemSettingManager )
+    {
+        this.systemSettingManager = systemSettingManager;
+    }
+
     // -------------------------------------------------------------------------
     // Implementing methods
     // -------------------------------------------------------------------------
@@ -594,4 +604,17 @@
     {
         return userAuthorityGroupStore.countDataSetUserAuthorityGroups( dataSet );
     }
+
+    @Override
+    public boolean credentialsNonExpired( UserCredentials credentials )
+    {
+        Integer credentialsExpires = systemSettingManager.credentialsExpires();
+
+        if ( credentialsExpires == null || credentialsExpires == 0 )
+        {
+            return true;
+        }
+
+        return true;
+    }
 }

=== modified file 'dhis-2/dhis-web/dhis-web-commons/src/main/java/org/hisp/dhis/interceptor/SystemSettingInterceptor.java'
--- dhis-2/dhis-web/dhis-web-commons/src/main/java/org/hisp/dhis/interceptor/SystemSettingInterceptor.java	2013-11-25 09:51:18 +0000
+++ dhis-2/dhis-web/dhis-web-commons/src/main/java/org/hisp/dhis/interceptor/SystemSettingInterceptor.java	2013-12-18 15:08:00 +0000
@@ -97,6 +97,7 @@
         map.put( KEY_CONFIGURATION, configurationService.getConfiguration() );
         map.put( KEY_APP_BASE_URL, systemSettingManager.getSystemSetting( KEY_APP_BASE_URL ) );
         map.put( KEY_GOOGLE_ANALYTICS_UA, systemSettingManager.getSystemSetting( KEY_GOOGLE_ANALYTICS_UA, "" ) );
+        map.put( KEY_CREDENTIALS_EXPIRES, systemSettingManager.credentialsExpires() );
 
         map.put( SYSPROP_PORTAL, defaultIfEmpty( System.getProperty( SYSPROP_PORTAL ), String.valueOf( false ) ) );
 

=== modified file 'dhis-2/dhis-web/dhis-web-maintenance/dhis-web-maintenance-settings/src/main/java/org/hisp/dhis/settings/action/system/SetAccessSettingsAction.java'
--- dhis-2/dhis-web/dhis-web-maintenance/dhis-web-maintenance-settings/src/main/java/org/hisp/dhis/settings/action/system/SetAccessSettingsAction.java	2013-08-23 16:05:01 +0000
+++ dhis-2/dhis-web/dhis-web-maintenance/dhis-web-maintenance-settings/src/main/java/org/hisp/dhis/settings/action/system/SetAccessSettingsAction.java	2013-12-18 15:08:00 +0000
@@ -28,6 +28,7 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+import com.opensymphony.xwork2.Action;
 import org.hisp.dhis.configuration.Configuration;
 import org.hisp.dhis.configuration.ConfigurationService;
 import org.hisp.dhis.i18n.I18n;
@@ -38,9 +39,8 @@
 import org.hisp.dhis.user.UserService;
 import org.springframework.beans.factory.annotation.Autowired;
 
-import com.opensymphony.xwork2.Action;
-
 import static org.hisp.dhis.setting.SystemSettingManager.KEY_ACCOUNT_RECOVERY;
+import static org.hisp.dhis.setting.SystemSettingManager.KEY_CREDENTIALS_EXPIRES;
 
 /**
  * @author Lars Helge Overland
@@ -50,13 +50,13 @@
 {
     @Autowired
     private ConfigurationService configurationService;
-    
+
     @Autowired
     private SystemSettingManager systemSettingManager;
-    
+
     @Autowired
     private UserService userService;
-    
+
     @Autowired
     private OrganisationUnitService organisationUnitService;
 
@@ -84,7 +84,14 @@
     {
         this.accountRecovery = accountRecovery;
     }
-    
+
+    private Integer credentialsExpires;
+
+    public void setCredentialsExpires( Integer credentialsExpires )
+    {
+        this.credentialsExpires = credentialsExpires;
+    }
+
     // -------------------------------------------------------------------------
     // Output
     // -------------------------------------------------------------------------
@@ -111,24 +118,29 @@
     {
         UserAuthorityGroup group = null;
         OrganisationUnit unit = null;
-        
+
         if ( selfRegistrationRole != null )
         {
             group = userService.getUserAuthorityGroup( selfRegistrationRole );
         }
-        
+
         if ( selfRegistrationOrgUnit != null )
         {
             unit = organisationUnitService.getOrganisationUnit( selfRegistrationOrgUnit );
         }
-        
+
         Configuration config = configurationService.getConfiguration();
         config.setSelfRegistrationRole( group );
         config.setSelfRegistrationOrgUnit( unit );
         configurationService.setConfiguration( config );
 
         systemSettingManager.saveSystemSetting( KEY_ACCOUNT_RECOVERY, accountRecovery );
-        
+
+        if ( credentialsExpires != null )
+        {
+            systemSettingManager.saveSystemSetting( KEY_CREDENTIALS_EXPIRES, credentialsExpires );
+        }
+
         message = i18n.getString( "settings_updated" );
 
         return SUCCESS;

=== modified file 'dhis-2/dhis-web/dhis-web-maintenance/dhis-web-maintenance-settings/src/main/resources/org/hisp/dhis/settings/i18n_module.properties'
--- dhis-2/dhis-web/dhis-web-maintenance/dhis-web-maintenance-settings/src/main/resources/org/hisp/dhis/settings/i18n_module.properties	2013-11-25 09:51:18 +0000
+++ dhis-2/dhis-web/dhis-web-maintenance/dhis-web-maintenance-settings/src/main/resources/org/hisp/dhis/settings/i18n_module.properties	2013-12-18 15:08:00 +0000
@@ -61,4 +61,7 @@
 port=Port
 tls=TLS
 allows_html=allows HTML
-application_footer=Application footer
\ No newline at end of file
+application_footer=Application footer
+user_credentials_expires=Require account password change
+never=Never
+months=Months
\ No newline at end of file

=== modified file 'dhis-2/dhis-web/dhis-web-maintenance/dhis-web-maintenance-settings/src/main/webapp/dhis-web-maintenance-settings/systemAccessSettings.vm'
--- dhis-2/dhis-web/dhis-web-maintenance/dhis-web-maintenance-settings/src/main/webapp/dhis-web-maintenance-settings/systemAccessSettings.vm	2012-11-04 08:37:25 +0000
+++ dhis-2/dhis-web/dhis-web-maintenance/dhis-web-maintenance-settings/src/main/webapp/dhis-web-maintenance-settings/systemAccessSettings.vm	2013-12-18 15:08:00 +0000
@@ -4,14 +4,15 @@
         jQuery.postUTF8( "setSystemAccessSettings.action", {
             selfRegistrationRole: jQuery( "#selfRegistrationRole" ).val(),
             selfRegistrationOrgUnit: jQuery( "#selfRegistrationOrgUnit" ).val(),
-            accountRecovery: jQuery( '#accountRecovery' ).is( ':checked' )
+            accountRecovery: jQuery( '#accountRecovery' ).is( ':checked' ),
+            credentialsExpires: jQuery( '#credentialsExpires' ).val()
         }, function( json ) {
             if ( json.response == "success" ) {
                 setHeaderDelayMessage( json.message );
             }
         } );
     } );
-} );    
+} );    
 </script>
 
 #set( $curRole = $keyConfig.selfRegistrationRole )
@@ -44,7 +45,18 @@
 
 <div class="setting">
 	<input type="checkbox" id="accountRecovery" name="accountRecovery"#if( $keyAccountRecovery ) checked="checked"#end>
-	<label for="accountRecovery">$i18n.getString( "enable_user_account_recovery" )</label>
+	<label for="accountRecovery">$i18n.getString( "enable_user_account_recovery" )</label>
+</div>
+
+<div class="settingLabel">$i18n.getString( "user_credentials_expires" )</div>
+
+<div class="setting">
+<select id="credentialsExpires" name="credentialsExpires">
+	<option value="0">[ $i18n.getString( "never" ) ]</option>
+	<option value="3" #if( $credentialsExpires == 3 )selected="selected"#end>3 $i18n.getString( "months" )</option>
+	<option value="6" #if( $credentialsExpires == 6 )selected="selected"#end>6 $i18n.getString( "months" )</option>
+	<option value="12" #if( $credentialsExpires == 12 )selected="selected"#end>12 $i18n.getString( "months" )</option>
+</select>
 </div>
 
 <div class="setting"><input type="button" value="$i18n.getString( 'save' )" style="width:10em"/></div>