Identity object contains credeantial tag with password metadata.
There is modifyTimestamp, but it lacks createTimestamp part. So for new password, there is no information when this happened.
- we need to show to the user, when his/her password expires.
- for this, we need password create/modify timestamp and expiration time from password policy
- we have all except create timestamp. So we can tell to the user password expiration only after second password change (set + change)