Pulp

I think of this story as capturing the use case to change a password. Changing a password causes all existing JWT tokens to expire which is a side-effect of the changing the password. I think the config portion should be removed from this story because that is part of #2367

I thought that password change will be captured by the work on User model but now I agree that it makes sense to track it separately.
I also imagined that password expiration time and JWT expiration time can be different. It is also would be more clear for users what setting they set, in case they use basic auth on every request (password expiration) or when they use some kind of external auth (only JWT expiration makes sense). I suggest not to remove but to move config portion from this story to #2367, so there will be two different config options to implement in it.
What do you think?

I imagined only 1 config and it would be the valid length a JWT token is accepted for. I did not think we would require users to change their passwords. When I read the title about a password "expiring" I thought you meant a JWT expiring. I don't think passwords should be required to be changed.