active directory - LDAP pwdlastset unable to change without error showing -


i have problem in need of with.

i use ldap php authenticate users, check see if users password marked expired. works fine if user's password has not expired or if admins have tick box force password reset. problem when password expires through group policies.

to make can still authenticate user when password marked expired, need change pwdlastset value -1 , in first place. throws , exception whenever password has expired instead of changing pwdlastset value.

exception:

0x50 (other (e.g., implementation specific) error; 00000057: syserr: dsid-031a1202, problem 22 (invalid argument), data 0 ): updating: cn=steve,ou=developer groups,dc=external,dc=domain,dc=local in 

can confirm me whether i'm right in thinking cannot change value once password has expired through policies or not?

if unable change value, there not work around?

thanks

only system can modify pwdlastset attribute value other 0 or -1. if assign 0, password expired. when user changes password current date/time assigned system pwdlastset attribute.

the value -1 corresponds largest integer allowed in 64-bit attribute, 2^63-1. value reverse of 0. makes password not expired. when user next logs on, pwdlastset attribute set system value corresponding current date/time.


Comments

Popular posts from this blog

How to remove text and logo OR add Overflow on Android ActionBar using AppCompat on API 8? -

html - How to style widget with post count different than without post count -

url rewriting - How to redirect a http POST with urlrewritefilter -