accountExpires shows previous evening in AD when using EPOCH_TIME_WIN32

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

I’m setting the accountExpires attribute using a dateFormat transform with EPOCH_TIME_WIN32. The identity attribute endDate is date only and during account creation in AD I see the following behavior:

endDate: 2035-08-03
Expected: Aug 3, 2035, 11:00:00 PM CDT
Actual: Aug 2, 2035, 7:00:00 PM CDT

Transform:

{
    "name": "Set AD accountExpires",
    "type": "dateFormat",
    "attributes": {
        "input": {
            "type": "identityAttribute",
            "attributes": {
                "name": "endDate"
            }
        },
        "inputFormat": "YYYY-MM-dd",
        "outputFormat": "EPOCH_TIME_WIN32"
    },
    "internal": false
}

I understand that accountExpires is stored as a Windows FILETIME value (UTC) and AD displays it in local time but I’m trying to understand whether it’s possible in ISC to make the expiration align with the end of the selected day when the authoritative source provides only a date (no time).

Any guidance or recommendations would be appreciated.

2

@rg60115 It works in my env., i have removed some of the code and pasting the logic for converting the date,

     "attributes": {
      "accountExpires": {
        "type": "dateFormat",
        "attributes": {
          "input": {
            "type": "dateMath",
            "attributes": {
              "expression": "+23h+59m+59s",
              "roundUp": true,
              "input": {
                "type": "dateFormat",
                "attributes": {
                  "input": {
                    "type": "firstValid",
                    "attributes": {
                      "values": [                                                
                        {
                          "attributes": {
                            "sourceName": "Non-Embedded NELM",
                            "attributeName": "endDate",
                            "accountSortAttribute": "modified",
                            "accountSortDescending": true
                          },
                          "type": "accountAttribute"
                        },
                        "9999-01-01"
                      ]                    
                  },
                  "inputFormat": "yyyy-MM-dd",
                  "outputFormat": "ISO8601"
                }
              }
            }
          },
          "inputFormat": "yyyy-MM-dd'T'HH:mm:ss",
          "outputFormat": "EPOCH_TIME_WIN32"
        }
      }
    "internal": false
  }
 }
3

@rg60115

you can use the below transform for refrence we had similar issues

{
       
        "name": "Generate-accountExpiry",
        "type": "dateFormat",
        "attributes": {
            "input": {
                "attributes": {
                    "input": {
                        "attributes": {
                            "input": {
                                "attributes": {
                                    "values": [
                                        {
                                            "attributes": {
                                                "name": "endDate"
                                            },
                                            "type": "identityAttribute"
                                        },
                                        "2999-12-31"
                                    ]
                                },
                                "type": "firstValid"
                            },
                            "inputFormat": "yyyy-MM-dd",
                            "outputFormat": "ISO8601"
                        },
                        "type": "dateFormat"
                    },
                    "expression": "+1d",
                    "roundUp": true
                },
                "type": "dateMath"
            },
            "inputFormat": "yyyy-MM-dd'T'HH:mm'Z'",
            "outputFormat": "EPOCH_TIME_WIN32"
        },
        "internal": false
    }