Suppose you get users from an external service. In the case where the user is locked or has temporary password in the Service, I redirect the user to a change-password page in Drupal and assign to him a "tmp_pass" Role. When the user has that role, he can't see anything but that page.
How should I restrict the access to all paths/menus in one place?
I thought of implementing
hook_menu_alter() and in the case of "tml_pass" role, assigning a new access callbacks to all the menus, but this is probably not a performance solution.
How can I achieve this?