Forum Discussion

Alberto_Flores's avatar
Alberto_Flores
Icon for Nimbostratus rankNimbostratus
Feb 18, 2022

AD password expired check in Active Directory Query

Hello i'm facing this issue and I could only find this solution.

Solved: AD password expired - DevCentral (f5.com)

For our flow is impossible to apply the same solution as we need to do that check almost at the end of the flow after dozen of other checks.
 
In the post is a link related with another possibility 

if "pwdLastSet" + "Max-Pwd-Age" >= "now" "password is expired"

 How can we translate this into the expr ?

expr {[mcget {session.logon.last.pwdLastSet + session.logon.last.maxPwdAge }] equals  session.logon.last.LastLogonTimeStamp  }

Is this expr correct ?

Kind regards

 

ad query
BIG-IP
security

1 Reply

Sort By
  • Sebastiansierra's avatar
    Sebastiansierra
    Icon for MVP rankMVP
    Feb 22, 2022

    Hi,

    The expressión is wrong because you are trying to call some variables that doesn´t exist:

    1.session.logon.last.pwdLastSet = session.ad.last.attr.pwdLastSet

    2.session.logon.last.maxPwdAge= session.logon.last.attr.maxPwdAge

    3.session.logon.last.LastLogonTimeStamp= session.user.starttime

    So, the next step is to create an AD Query before Ad Auth and Required Attributes:

    1.pwdLastSet

    2.maxPwdAge

    Could you try to configure the Ad Query and see if you receive the values from the AD? I´m trying to do it in my lab but for some reason, I don´t receive the maxPwdAge and I think that the problem is my AD