Account Create Attribute Configuration Issue

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Our tenant receives new user data from an HR-based source of truth. During onboarding, SailPoint uses a transform to generate a temporary password that is easy for users to remember during orientation and is intended to be changed immediately after their first login.

However, we’ve discovered that SailPoint is not automatically setting the “User must change password at next logon” flag in Active Directory for these new accounts:

image

As a temporary workaround, we’ve been setting this flag manually in AD. To automate this, we attempted to configure the Active Directory source settings in SailPoint by going to the Create Account section and setting the pwdLastSet attribute to 0 with a Static value. Unfortunately, this did not work during today’s onboarding.

image
image831×221 6.81 KB

We’re trying to determine:

  • Are we misconfiguring something?
  • Is there a more reliable or recommended way to ensure that new users are required to change their password at next logon?

Any guidance or best practices would be appreciated.

2

For the “User must change password at next logon,” try setting pwdLastSet as true.

2 Likes
3

Just want to add below document for reference: Default Provisioning Attributes Reference - expand Account Creation section

image
image1467×326 21.3 KB

1 Like
4

Hey @vishal_kejriwal1 pardon my shallow understanding of the topic. How do I set the value to true? I don’t see an option for that.

5

Hey @pattabhi thanks for the reply. If I’m reading this correctly, if I set the value to static, it automatically is read as -1/false? If that is the case, how do I set it to true? I assumed Static would let us use the preconfigured password supplied by the transform and 0 would set the flag after the first logon. Please pardon my lack of understanding.

6

Hi @jared-fox

As shown below,
radio buttons select as Static and Static value to true.

image
image548×131 2.93 KB

I know why there is a confusion, there should be a drop-down value true or false which will avoid confusion … but the current behavior is: we need to write manually: true or false.

As per document this attribute: Static value can only be set as true or false. {while radio buttons select as Static}

  • When Static value set to true, the pwdLastSet attribute value is set to 0 in backend and it selects the User must change password on logon checkbox for the Active Directory user object’s account in ADUC.

  • When Static value set to false, the pwdLastSet attribute value is set to -1 in backend and sets this attribute to the current time, and it deselects the User must change password on logon checkbox.

7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.