@Test
    void verifyExpiredPassword() throws Throwable {
        val jwtProcessor = getConfigurableJWTProcessor("casuser");

        val provider = mock(CognitoIdentityProviderClient.class);
        val initResult1 = AdminInitiateAuthResponse.builder().challengeName("NEW_PASSWORD_REQUIRED").build();
        when(provider.adminInitiateAuth(any(AdminInitiateAuthRequest.class))).thenReturn(initResult1);

        val creds = CoreAuthenticationTestUtils.getCredentialsWithDifferentUsernameAndPassword("casuser-exp-password", "Hell063!!");
        val handler = new AmazonCognitoAuthenticationAuthenticationHandler(mock(ServicesManager.class),
            PrincipalFactoryUtils.newPrincipalFactory(), provider, casProperties.getAuthn().getCognito(), jwtProcessor);

        assertThrows(AccountPasswordMustChangeException.class, () -> handler.authenticate(creds, mock(Service.class)));
    }
This is {@link AmazonCognitoAuthenticationAuthenticationHandlerTests}.

@author Misagh Moayyed
@since 6.0.0
support/cas-server-support-aws-cognito-authentication/src/test/java/org/apereo/cas/authentication/AmazonCognitoAuthenticationAuthenticationHandlerTests.java