Can't map pwdLastSet Active Directory attribute

Forum|Forum|6 years ago
February 4, 2020
2 replies
1860 views

I am trying to map the pwdLastSet AD attribute to a User Extenstion via Directory Services. I added a property to the User Extension Thing Shape with Base Type = LONG:

Next, I mapped the AD attribute to the user extension with a default value of 237 (I set a default is to show that the value is not being set properly):

However, the value is not set properly. Here is a screen shot of my user extenstions to show that the value is zero:

It is not the value from my AD attribute:

It was also not set to the default value 237.

Are there limitations to which AD attributes can be mapped to user extensions?

Thanks,

Steve

Security

Best answer by raluca_edu

Hi Steve,

What version of ThingWorx are you using?

Could you check the Application.log and Security.log for errors or attach them here?

Thank you,

Raluca Edu

raluca_edu

Answer

17-Peridot

Hi Steve,

What version of ThingWorx are you using?

Could you check the Application.log and Security.log for errors or attach them here?

Thank you,

Raluca Edu

S

steve237

Author

14-Alexandrite

Raluca,

I had been checking the Application log file all along for errors, but unfortunately had failed to check the security log.

The security log had error: General error occurred. [explanation: java.lang.Exception: User does not exist in AD, the credentials are invalid, or the User ID Attribute Name Schema Mapping is incorrect.] each time I logged in. More research showed that the directory service I was using for testing was causing that error, so the second dir service in the list was actually doing the authentication! (I had not done the same mapping in the second directory service.) Of course, once I updated the mapping in the 2nd service it started to populate the pwdLastSet user extension. Problem solved.

Thanks for the hint.