code: public boolean requiresPasswordChange(CmsObject cms, CmsUser user) {
  
          if (user.isManaged()
              || user.isWebuser()
              || OpenCms.getDefaultUsers().isDefaultUser(user.getName())
              || OpenCms.getRoleManager().hasRole(cms, user.getName(), CmsRole.ROOT_ADMIN)) {
              return false;
          }
          String lastPasswordChangeStr = (String)user.getAdditionalInfo().get(
              CmsUserSettings.ADDITIONAL_INFO_LAST_PASSWORD_CHANGE);
          if (lastPasswordChangeStr == null) {
              return false;
          }
          long lastPasswordChange = Long.parseLong(lastPasswordChangeStr);
          if ((System.currentTimeMillis() - lastPasswordChange) > getPasswordChangeInterval()) {
              return true;
          }
          return false;
      }
docs: Checks if a user is required to change his password now.<p>
  
  @param cms the current CMS context
  @param user the user to check
  
  @return true if the user should be asked to change his password