Comment 1 for bug 1688119

I cannot recreate this, it works correctly for me. Using master as of about 2 weeks ago.

keystone.conf:

[security_compliance]
# Configuring password expiration
password_expires_days = 1
# Force users to immediately change their password upon first use
change_password_after_first_use = true

pi@controllerpi:~ $ date -u
Tue Jun 20 22:09:05 UTC 2017
pi@controllerpi:~ $ openstack user create demo --password demo --domain default
+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | 045f275ca5d342ff801302350ade48fc |
| name | demo |
| options | {} |
| password_expires_at | 2017-06-20T22:09:34.826090 |
+---------------------+----------------------------------+
pi@controllerpi:~ $ openstack user set demo --password demo1
pi@controllerpi:~ $ openstack user show demo
+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | 045f275ca5d342ff801302350ade48fc |
| name | demo |
| options | {} |
| password_expires_at | 2017-06-20T22:11:04.000000 |
+---------------------+----------------------------------+
pi@controllerpi:~ $ date -u
Tue Jun 20 22:11:10 UTC 2017