Comment 3 for bug 1791111

Keystone does not allow "login" for locked passwords, which includes ones marked for "change before first use". Horizon needs to implement a "change password form" (or a user must use the /v3/users/password API directly).

This is not something that can/will be fixed in keystone.