Only calculate LDAP password grace when the password is expired
The user's pwd expiration was retrieved but inadvertently was never
compared to current time. So any LDAP bind, including from the
IPA API, counted against the grace period. There is no need to go
through the graceperiod code for non-expired passwords.
Signed-off-by: Rob Crittenden <firstname.lastname@example.org>
Reviewed-By: Florence Blanc-Renaud <email@example.com>