Unable to create account in AD with SetRandompassword as False

[piyushm]

I am trying to create a service account in AD with SetRandompassword set to FALSE. The task is failing with LDAP error code 53-SVCErr: DSID-031A126A, problem 5003.

In the createaccountjson I am passing the userPassword using the dynamic attribute where user can I enter the password(as per password policy). The requirement is to not use randompassword.

Please let me know if anyone has faced this issue.

[rushikeshvartak]

Is it following AD Policy of AD. please share json

[piyushm]

Unable to copy the json here. But I am using "userPassword": ${password} (password is dynamic attribute) and all other mappings are as per connector guide.

The same json works if setrandompassword is set to TRUE. The account gets created in AD.

And I can see the userPassword attribute value in AD set to the password entered in ARS form. But when I bind using that password in AD it fails. So Is it possible that AD is not using userPassword attribute and storing the random generated password  internally?

[avinashchhetri · Accepted solution]

@piyushm,

Try "UnicodePwd": ${password} instead of "userPassword": ${password} 

[piyushm]

@avinashchhetri @rushikeshvartak - Thank you. I am able to create account with "UnicodePwd".

However, when I am using thesame in RESETANDCHANGEPASSWORDJSON, It is not working.

Meaning, when I change password using Change Password for Service Account Tile, the task gets completed but the new pwd is not working in AD. I only see pwdlastset as 0 in AD and whenchanged attribute updated to task completion timestamp.

I am using below:

{

"RESET":{
"pwdLastSet":"0",
"title":"password reset"},
"CHANGE":{

"UnicodePwd": {task.password},
"pwdLastSet":"-1",

"title":"password changed"}
}

[avinashchhetri]

@piyushm,

You need not set the UnicodePwd parameter in the RESETANDCHANGEPASSWORDJSON.

This functionality will trigger when you either reset password on behalf of others or change it for yourself, in both cases you provide the password explicitly. The internal logic picks it from the task table and send it across to the target instance.

[rushikeshvartak]

{"RESET": {"pwdLastSet": "0","title": "password reset"},"CHANGE": {"pwdLastSet": "-1","lockoutTime": 0,"title": "password changed"}}

[rushikeshvartak]

{
"cn" : "${cn}",
"givenName" : "${user.firstname}",
"objectclass" : [
"top",
"person",
"organizationalPerson",
"user"
],
"pwdLastSet" : "0",
"samaccountname" : "${samaccountname}",
"sn" : "${user.lastname}",
"unicodepwd" : "SaviyntForum@123qazxswedc",
"userPrincipalName" : "${userPrincipalName}",
"extensionAttribute1":"To be Deleted"
}

[piyushm]

It works only if I pass "pwdLastSet":"-1" for RESET.  CHANGE paramenter does not make any update. It just resets the lastpwdset to 0 even if I pass it as -1.

Note that it is for Service Account.

{

"RESET":{
"pwdLastSet":"-1",
"title":"password reset"},
}

[avinashchhetri]

@piyushm,

How are you resetting the password for the service account ? from the UI or the API ?

Also it would make sense to start a new thread for this question as your original question seems to now have been answered.

[piyushm]

@avinashchhetri 

I am resetting the password from UI. I will start a new thread if needed.

[JohnLawson]

Did you ever get a resolution for this? I am having a similar problem.

[piyushm]

Which json are you referring to?

For RESETANDCHANGEPASSWRDJSON, I used 

{
"RESET":{
"pwdLastSet":"-1"
}

}

For Createaccountjson it worked if I set these 2 parameters while creating account.

"accountExpires":"${if(ServiceAccountOwnerMap.ServiceAccountType.equals('Service Account')) {} else {0}}",
"pwdLastSet":"${if(ServiceAccountOwnerMap.ServiceAccountType.equals('Service Account')) {-1} else {0}

[JohnLawson]

The CHANGE parameter in the RESETANDCHANGEPASSWORDJSON. Were you able to get that working?

[piyushm]

You don't need CHANGE parameter. The RESET parameter alone does the job.