It would be nice if FreeIPA would prevent password reuse based on age, instead of history length. Meaning the ability to configure FreeIPA to enforce that a password cannot be reused within the last 1 year, regardless of how many times the user's password has been changed.

Currently password history is stored based on a history length. And when an organization has password expiration requirements, to keep people from just changing their password X number of times so they can reuse their original, you must set the minimum password age to a high enough value to be an annoyance to such users. This is a rather crude solution to the problem, as the solution is essentially: "make it annoying enough so people don't do it".

I've previously implemented this feature when using OpenLDAP by writing a custom extension that when the password was changed, the previous one was stored with a timestamp of the change date. For enforcement, OpenLDAP would compare against passwords timestamped within the policy's history age, or history length. The solution worked rather well, and it would nice if such a feature could be implemented within FreeIPA.