I would encourage tibco engineers to develop a way to identify how a system admin for spotfire support can manage passwords, such as set them to expire, and ask the user to reset after certain number of days. Current state is a user when having LDAP authentication can continue to use an expired password just as freely as a user whose password has not expired.
User Kerberos authentication and you won't have this problem.