ADSI RESETANDCHANGEPASSWRDJSON Change Reset Password Functionality

[ReshamDas]

Hi,

We understand that the AD connector on Saviynt has RESETANDCHANGEPASSWRDJSON parameter, where specific logic can be implemented for the two distinct cases of Change Password (when user changes own AD account password) and Reset Password (when someone else changes user's AD account password) from Saviynt UI, which can be defined within CHANGE and RESET blocks respectively, like in this example:-

{
"RESET": {
"pwdLastSet": "0" ,
"title": "password reset",
"password": "${password}"
},
"CHANGE": {
"pwdLastSet": "-1",
"title": "password changed",
"password": "${password}"
}
}

However, the sample code in the ADSI documentation here does not give example of if this segregation between Change Password and Reset Password can be performed in ADSI connector.

We tried with below code but it threw error:-

{
"RESET": {
"objects": [
{
"objectClasses": [
"user"
],
"password": "${password}",
"distinguishedName": "${account.customproperty25}",
"attributes": {
"pwdLastSet": "0"
}
}
]
},
"CHANGE": {
"objects": [
{
"objectClasses": [
"user"
],
"password": "${password}",
"distinguishedName": "${account.customproperty25}",
"attributes": {
"pwdLastSet": "-1"
}
}
]
}
}

Error message: Error in change password: { "status": "Failure", "message": "'objectClasses' and 'distinguishedName' are mandatory attributes."

Hence, kindly suggest if this can be implemented in the ADSI RESETANDCHANGEPASSWRDJSON by any means.

[stalluri]

@ReshamDas 

{
    "RESET": {
        "objects": [
            {
                "objectClasses": [
                    "user"
                ],
                "password": "${password}",
                "distinguishedName": "${account.customproperty25?.replace('\\', '\\\\')?.replace('/', '\\/')}",
                "attributes": {
                    "pwdLastSet": "0"
                }
            }
        ]
    },
    "CHANGE": {
        "objects": [
            {
                "objectClasses": [
                    "user"
                ],
                "password": "${password}",
                "distinguishedName": "${account.customproperty25?.replace('\\', '\\\\')?.replace('/', '\\/')}",
                "attributes": {
                    "pwdLastSet": "-1"
                }
            }
        ]
    }
}

[ReshamDas]

@stalluri I see you added the replace functions to the CP25 attribute for replacing \ and / characters. But, this too returned same error message: Error in change password: { "status": "Failure", "message": "'objectClasses' and 'distinguishedName' are mandatory attributes."

[ReshamDas]

I figured out the below code for ADSI to handle the Change Password (self-initiated) and Reset Password (admin-initiated) scenarios differently, using Java if-else:-

{
"objects": [
{
"objectClasses": [
"user"
],
"password": "${password}",
"distinguishedName": "${account.customproperty25}",
"attributes": {
"pwdLastSet": 
"${if(arstasksObj?.source.equals('changeOwnPasswordFromUI') || arstasksObj?.source.equals('forgotPassword') || ('dll_by_user').equalsIgnoreCase(arstasksObj?.source)){return -1}else{return 0}}"
}
}
]
}

I was able to test my scenarios successfully with above code. Kindly review this snippet and let me know if this has all, or if any improvements required.

[rushikeshvartak · Accepted solution]

{
  "objects": [
    {
      "objectClasses": [
        "user"
      ],
      "password": "${password}",
      "distinguishedName": "${accountsObj?.customproperty25}",
      "attributes": {
        "pwdLastSet": "${if(arstasksObj?.source.equalsIgnoreCase('changeOwnPasswordFromUI') || arstasksObj?.source.equalsIgnoreCase('forgotPassword') || ('dll_by_user').equalsIgnoreCase(arstasksObj?.source)){return -1}else{return 0}}"
      }
    }
  ]
}