Skip to content

Wrong password expiration date when pwdLastSet is 0 #8153

Description

@DavidePrincipi

When NS8 lists users from a remote Active Directory, some accounts that never had a password set show a wrong password expiration date, far in the past instead of a neutral value.

To Reproduce

  1. Connect NS8 to a remote AD domain that has at least one account whose password was never set (or one flagged "must change password at next login").
  2. Run: api-cli run list-domain-users --data '{"domain":"<your-domain>"}'
  3. Check the "password expiration" value returned for that account.

Expected behavior
For an account with no password set, password_expiration should be 0, not a real date. The UI code that reads this value has been checked and already handles 0 correctly, so no further UI changes are needed.

Actual behavior
The tool returns a nonsense date, for example:

"password_expiration": -11636697600

Active Directory uses a special marker to mean "no password set yet," but NS8 treats it as a real date and calculates from it anyway.

Components
NS8 core 3.21.1

Additional context
Found while investigating the related krbtgt_AzureAD issue (#8151).

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

No labels
No labels

Type

Projects

  • Status
    In Progress

Relationships

None yet

Development

No branches or pull requests

Issue actions