Index: lams_central/src/java/org/lamsfoundation/lams/web/IndexController.java
===================================================================
diff -u -r92525f17be9db4e57a8551ff92d004f319fb4b73 -r7fe28edd2994800c1cbd0a81b19f398191e00f2e
--- lams_central/src/java/org/lamsfoundation/lams/web/IndexController.java	(.../IndexController.java)	(revision 92525f17be9db4e57a8551ff92d004f319fb4b73)
+++ lams_central/src/java/org/lamsfoundation/lams/web/IndexController.java	(.../IndexController.java)	(revision 7fe28edd2994800c1cbd0a81b19f398191e00f2e)
@@ -96,20 +96,26 @@
 	    userDTO.setFirstLogin(false);
 	}
 
-	if (user.getPasswordChangeDate() != null) {
-	    int expirationPeriod = Configuration.getAsInt(ConfigurationKeys.PASSWORD_EXPIRATION_MONTHS);
-	    if (expirationPeriod > 0) {
-		LocalDateTime expirationDate = user.getPasswordChangeDate().plusMonths(expirationPeriod);
-		if (LocalDateTime.now().isAfter(expirationDate)) {
-		    user.setChangePassword(true);
-		    userManagementService.save(user);
-		    return "forward:/password.do?passwordExpired=true";
+	HttpSession session = request.getSession();
+	Boolean isIntegrationLogin = (Boolean) session.getAttribute("isIntegrationLogin");
+	isIntegrationLogin = isIntegrationLogin != null && isIntegrationLogin;
+
+	if (!isIntegrationLogin) {
+	    if (user.getPasswordChangeDate() != null) {
+		int expirationPeriod = Configuration.getAsInt(ConfigurationKeys.PASSWORD_EXPIRATION_MONTHS);
+		if (expirationPeriod > 0) {
+		    LocalDateTime expirationDate = user.getPasswordChangeDate().plusMonths(expirationPeriod);
+		    if (LocalDateTime.now().isAfter(expirationDate)) {
+			user.setChangePassword(true);
+			userManagementService.save(user);
+			return "forward:/password.do?passwordExpired=true";
+		    }
 		}
 	    }
-	}
 
-	if (user.getChangePassword() != null && user.getChangePassword()) {
-	    return "forward:/password.do";
+	    if (user.getChangePassword() != null && user.getChangePassword()) {
+		return "forward:/password.do";
+	    }
 	}
 
 	// check if user needs to get his shared two-factor authorization secret
Index: lams_central/web/login.jsp
===================================================================
diff -u -r01792e22e47468240e10ebec63a0a7af5e6dd592 -r7fe28edd2994800c1cbd0a81b19f398191e00f2e
--- lams_central/web/login.jsp	(.../login.jsp)	(revision 01792e22e47468240e10ebec63a0a7af5e6dd592)
+++ lams_central/web/login.jsp	(.../login.jsp)	(revision 7fe28edd2994800c1cbd0a81b19f398191e00f2e)
@@ -188,10 +188,12 @@
 			<%
 				// invalidate session so a new user can be logged in
 				HttpSession hs = SessionManager.getSession();
+				Boolean isSignup = false;
+				
 				if (hs != null) {
 					UserDTO userDTO = (UserDTO) hs.getAttribute("user");
 					if (userDTO != null && !userDTO.getLogin().equals(request.getAttribute("login"))) {
-					    Object isSignup = hs.getAttribute("isSignup");
+					    isSignup = (Boolean) hs.getAttribute("isSignup");
 					    // remove session from mapping
 					    SessionManager.removeSessionByLogin(userDTO.getLogin(), true);
 					    
@@ -201,6 +203,9 @@
 					    hs.setAttribute("isLoginAs", request.getAttribute("isLoginAs"));
 					}
 				}
+				
+				hs = request.getSession();
+				hs.setAttribute("isIntegrationLogin", isSignup == null || !isSignup);
 			%>
 			<script type="text/javascript">
 				// submit the hidden form
Index: lams_common/src/java/org/lamsfoundation/lams/integration/security/SsoHandler.java
===================================================================
diff -u -r94a1023cbda3eab32ccba7c3f94c729bb0a32b28 -r7fe28edd2994800c1cbd0a81b19f398191e00f2e
--- lams_common/src/java/org/lamsfoundation/lams/integration/security/SsoHandler.java	(.../SsoHandler.java)	(revision 94a1023cbda3eab32ccba7c3f94c729bb0a32b28)
+++ lams_common/src/java/org/lamsfoundation/lams/integration/security/SsoHandler.java	(.../SsoHandler.java)	(revision 7fe28edd2994800c1cbd0a81b19f398191e00f2e)
@@ -165,6 +165,7 @@
 
 		boolean isUsingLoginAsFeature = isPasswordToken
 			&& Boolean.TRUE.equals(session.getAttribute("isLoginAs"));
+		boolean isIntegrationLogin = Boolean.TRUE.equals(session.getAttribute("isIntegrationLogin"));
 
 		// LoginRequestServlet (integrations) and LoginAsAction (sysadmin) set this parameter
 		String redirectURL = request.getParameter("redirectURL");
@@ -229,6 +230,7 @@
 
 		// session ID was changed after log in
 		SessionManager.updateSessionID(oldSessionID);
+		session.setAttribute("isIntegrationLogin", isIntegrationLogin);
 
 		if (login.equals(request.getRemoteUser())) {
 		    session.setAttribute(AttributeNames.USER, userDTO);