<!DOCTYPE html>
<html><head>
<meta charset="UTF-8">
</head><body><p class="default-style">Il 28 maggio 2019 alle 15.36 "Jeria, Esteban" <esteban.jeria@cgi.com> ha scritto:</p><blockquote type="cite"><div class="ox-10a50da590-WordSection1"><p class="ox-10a50da590-MsoNormal"><span style="font-size: 11.0pt; font-family: 'Calibri',sans-serif; color: #1f497d;">Any suggestion</span><span style="font-size: 11.0pt; font-family: 'Calibri',sans-serif; color: #1f497d;">? </span></p></div></blockquote><p class="default-style">We're not using that trick, but the value <span style="font-size: 10.0pt; font-family: 'Arial',sans-serif; color: black;">“000001010000Z”</span> looks too short to me: it is missing the seconds. See:</p><pre><span style="font-family: courier new, courier;">000001010000Z vs</span><br><span style="font-family: courier new, courier;">20050103121520Z</span></pre><p><br></p><p>Have you tried with 000001010000<span style="color: #ff0000;"><strong>00</strong></span>Z? Even though seconds are optional according to <a href="https://ldapwiki.com/wiki/GeneralizedTime">GeneralizedTime</a> schema definition.</p><p>Paolo</p><blockquote type="cite"><div class="ox-10a50da590-WordSection1"><p class="ox-10a50da590-MsoNormal"><span style="font-size: 11.0pt; font-family: 'Calibri',sans-serif; color: #1f497d;"> </span></p><p><strong><span style="font-size: 10.5pt; font-family: 'Arial',sans-serif; color: blue; background: white;">Esteban Jeria</span></strong></p><p><span style="font-size: 10.0pt; font-family: 'Tahoma',sans-serif; color: blue; background: white;"><a href="mailto:esteban.jeria@cgi.com"><span style="font-family: 'Arial',sans-serif;">esteban.jeria@cgi.com</span></a><br> </span><span style="font-size: 9.5pt; font-family: 'Calibri Light',sans-serif; color: black; background: white;">Conseiller </span><strong><span style="font-size: 9.5pt; font-family: 'Calibri Light',sans-serif; color: red; background: white;">CGI</span></strong><span style="font-size: 9.5pt; font-family: 'Calibri Light',sans-serif; color: black; background: white;"> / </span><strong><span style="font-size: 9.5pt; font-family: 'Calibri Light',sans-serif; color: red; background: white;">CGI</span></strong><span style="font-size: 9.5pt; font-family: 'Calibri Light',sans-serif; color: black; background: white;"> Consultant</span></p><p><span style="font-size: 9.5pt; font-family: 'Arial',sans-serif; color: black; background: white;">Sécurité - Gestion des Identités et des Accès / Security - Identity and Access Management</span></p><p class="ox-10a50da590-MsoNormal"><span style="font-size: 11.0pt; font-family: 'Calibri',sans-serif; color: #1f497d;"> </span></p><div><div style="border: none; border-top: solid #E1E1E1 1.0pt; padding: 3.0pt 0cm 0cm 0cm;"><p class="ox-10a50da590-MsoNormal"><strong><span style="font-size: 11.0pt; font-family: 'Calibri',sans-serif;">From:</span></strong><span style="font-size: 11.0pt; font-family: 'Calibri',sans-serif;"> Jeria, Esteban <esteban.jeria@cgi.com> <br> <strong>Sent:</strong> 25-Apr-19 2:04 PM<br> <strong>To:</strong> midpoint@lists.evolveum.com<br> <strong>Subject:</strong> [midPoint] Lock account using pwdAccountLockedTime on OpenLDAP </span></p></div></div><p class="ox-10a50da590-MsoNormal"> </p><div><div><p><span style="font-size: 10.0pt; font-family: 'Arial',sans-serif; color: black;">Hi,</span></p><p><span style="font-size: 10.0pt; font-family: 'Tahoma',sans-serif; color: black;"> </span></p><p><span style="font-size: 10.0pt; font-family: 'Arial',sans-serif; color: black;">I'm trying to configure a simulated capability to manage the status for an account on OpenLDAP using the attribute <strong><span style="font-family: 'Arial',sans-serif;">pwdAccountLockedTime</span></strong>.<br> Normally, a value "000001010000Z" means that the account is permanently locked and the absence of that attribute means the account is normal.</span></p><p><span style="font-size: 10.0pt; font-family: 'Tahoma',sans-serif; color: black;"> </span></p><p><span style="font-size: 10.0pt; font-family: 'Arial',sans-serif; color: black;"> <cap:activation><br> <cap:status><br> <cap:attribute>ri:pwdAccountLockedTime</cap:attribute><br> <cap:enableValue/><br> <cap:disableValue>000001010000Z</cap:disableValue><br> </cap:status><br> </cap:activation></span></p><p><span style="font-size: 10.0pt; font-family: 'Tahoma',sans-serif; color: black;"> </span></p><p><span style="font-size: 10.0pt; font-family: 'Arial',sans-serif; color: black;">However, midPoint seems to reject these values.<br> When I enable a user, the attribute should be removed, but I get this error:<br> For input string: "": For input string: "": For input string: "": For input string: ""</span></p><p><span style="font-size: 10.0pt; font-family: 'Tahoma',sans-serif; color: black;"> </span></p><p><span style="font-size: 10.0pt; font-family: 'Arial',sans-serif; color: black;">And when I disable a user, I get that error:<br> For input string: "000001010000Z": For input string: "000001010000Z": For input string: "000001010000Z": For input string: "000001010000Z"</span></p><p><span style="font-size: 10.0pt; font-family: 'Tahoma',sans-serif; color: black;"> </span></p><p><span style="font-size: 10.0pt; font-family: 'Arial',sans-serif; color: black;">I do not know if it is relevant, but according to the LDAP schema, the value must be of type "GeneralizedTime" but midPoint handle it as a "long" and seems to interpret the value entered as string because of the character "Z". <br> Any other numeric value (without "Z") is accepted and is converted to a date on OpenLDAP side.</span></p><p><span style="font-size: 10.0pt; font-family: 'Tahoma',sans-serif; color: black;"> </span></p><p><span style="font-size: 10.0pt; font-family: 'Tahoma',sans-serif; color: black;"> </span></p><div><div><div><p><strong><span style="font-size: 10.5pt; font-family: 'Arial',sans-serif; color: blue; background: white;">Esteban Jeria</span></strong></p><p><span style="font-size: 10.0pt; font-family: 'Tahoma',sans-serif; color: blue; background: white;"><a href="mailto:esteban.jeria@cgi.com"><span style="font-family: 'Arial',sans-serif;">esteban.jeria@cgi.com</span></a><br> </span><span style="font-size: 9.5pt; font-family: 'Calibri Light',sans-serif; color: black; background: white;">Conseiller </span><strong><span style="font-size: 9.5pt; font-family: 'Calibri Light',sans-serif; color: red; background: white;">CGI</span></strong><span style="font-size: 9.5pt; font-family: 'Calibri Light',sans-serif; color: black; background: white;"> / </span><strong><span style="font-size: 9.5pt; font-family: 'Calibri Light',sans-serif; color: red; background: white;">CGI</span></strong><span style="font-size: 9.5pt; font-family: 'Calibri Light',sans-serif; color: black; background: white;"> Consultant</span></p><p><span style="font-size: 9.5pt; font-family: 'Arial',sans-serif; color: black; background: white;">Sécurité - Gestion des Identités et des Accès / Security - Identity and Access Management</span></p></div></div></div></div></div></div></blockquote><p class="default-style"><br> </p><blockquote type="cite">_______________________________________________ <br>midPoint mailing list <br>midPoint@lists.evolveum.com <br>http://lists.evolveum.com/mailman/listinfo/midpoint</blockquote><p class="default-style"><br> </p></body></html>