From 1007d6a6d855c7df596905b63149bfb2a86d69f6 Mon Sep 17 00:00:00 2001 From: damien-malescot <13115071+damien-malescot@users.noreply.github.com> Date: Wed, 13 Jul 2022 15:59:50 +0200 Subject: [PATCH] Fix AD/LDS password expiration Closes #13084 --- .../MSADLDSUserAccountControlStorageMapper.java | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/msadlds/MSADLDSUserAccountControlStorageMapper.java b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/msadlds/MSADLDSUserAccountControlStorageMapper.java index 84bdf1236e..3bae11aacd 100644 --- a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/msadlds/MSADLDSUserAccountControlStorageMapper.java +++ b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/msadlds/MSADLDSUserAccountControlStorageMapper.java @@ -66,6 +66,10 @@ public class MSADLDSUserAccountControlStorageMapper extends AbstractLDAPStorageM // This needs to be read-only and can be set to writable just on demand query.addReturningReadOnlyLdapAttribute(LDAPConstants.PWD_LAST_SET); + // ask msds-user-password-expired in ldap query for required action UPDATE_PASSWORD + query.addReturningLdapAttribute(LDAPConstants.MSDS_USER_PASSWORD_EXPIRED); + query.addReturningReadOnlyLdapAttribute(LDAPConstants.MSDS_USER_PASSWORD_EXPIRED); + if (ldapProvider.getEditMode() != UserStorageProvider.EditMode.WRITABLE) { query.addReturningReadOnlyLdapAttribute(LDAPConstants.MSDS_USER_ACCOUNT_DISABLED); } @@ -263,9 +267,10 @@ public class MSADLDSUserAccountControlStorageMapper extends AbstractLDAPStorageM Stream requiredActions = super.getRequiredActionsStream(); if (ldapProvider.getEditMode() == UserStorageProvider.EditMode.WRITABLE) { - if (getPwdLastSet() == 0 || Boolean.parseBoolean(ldapUser.getAttributeAsString(LDAPConstants.MSDS_USER_PASSWORD_EXPIRED))) { - return Stream.concat(requiredActions, Stream.of(RequiredAction.UPDATE_PASSWORD.toString())).distinct(); - } + // update password only if force or expired and not updated (-1) + if (getPwdLastSet() == 0 || (getPwdLastSet() != -1 && Boolean.parseBoolean(ldapUser.getAttributeAsString(LDAPConstants.MSDS_USER_PASSWORD_EXPIRED)))) { + return Stream.concat(requiredActions, Stream.of(RequiredAction.UPDATE_PASSWORD.toString())).distinct(); + } } return requiredActions; }