We could probably model this logic as an ldaptive SearchEntryHandler in order to simply reuse the existing LdapAuthenticationHandler, but with modified configuration that specifies the PasswordExpirationSearchEntryHandler. The only obstacle I can foresee with that impl is that the signature for SearchEntryHandler throws LdapException, where we would need to throw a GeneralSecurityException.