Hi...
yes, you are right, I am woking with JSF.
I will add a new column "password_status" in the database;
this attribute will be set to true by default;
On logging, i will also check for this attribute besides userid & password;
I will write one method in managed bean which will
test for both userid,password & password_status;
based on the method outcome, proper page will be displayed.