Security - User is allowed to login even after the password expiry

login with a user whose password is expired

Actual behavior - user is allowed to log-in (refer attachment)
Expected behavior - user should not be allowed to login, appropriate password expiration and next steps should be shown.