I'm glad you raised these questions. One of the objectives is to generalize LPPE into a generic account/password expiration mechanism that can be implemented by any authentication handler where the concept of password expiration makes sense (e.g. RDBMS). This component simply attempts to map a reasonable javax.security exception onto a corresponding LPPE state transition, but the LDAP authentication handlers have not been modified to throw these exceptions yet.

As far as exposing this mapping as a configuration concern, I sincerely don't think there is a use case for it. It's a fairly low-level detail that takes a fair bit of research and testing to get right. I say this based in part on work we did for ldaptive, where this is an implementation detail not subject to configuration. If you can propose a reasonable use case for customization, I'd be willing to reconsider.