AnsweredAssumed Answered

AFX - Active Directory Update Attribute "logonHours" how?

Question asked by Andrew Beauchamp on Apr 4, 2018
Latest reply on Aug 13, 2018 by Andrew Beauchamp

Like • Show 0 Likes0
Comment • 10

Hello Experts.

Version: 7.0.0.101393 P01

Wondering if there is anyone out there that has had success in updating Active Directory Attribute "logonHours" ?

This AD attribute is an OctetString and I'm struggling to understand the correct format.

To prevent someone from authenticating to AD one can set the attribute zeros.

accessTU - Command processing errors

I've tried the following, byte, decimal, hex, etc... with and without spacing.

000000000000000000000000000000000000000000

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00

\00 \00 \00 \00 \00 \00 \00 \00 \00 \00 \00 \00 \00 \00 \00 \00 \00 \00 \00 \00 \00

\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00

\x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00

No one else has this question

Outcomes

10 Replies

Pradeep Kadambar Apr 4, 2018 12:22 PM
Mark Correct
Correct Answer
I have seen the WILL_NOT_PERFORM when you don't have sufficient right to perfrom the operation. So might want to check the service account permissions.

Not commenting specifically on how to set logonHours, if an attribute value is OctetString, then you should pass the base64 encoded string to AFX.
1 person found this helpful
Like • Show 1 Like1
Actions
- Andrew Beauchamp @ Pradeep Kadambar on Apr 5, 2018 2:34 AM
  Mark Correct
  Correct Answer
  Hello Pradeep.
  
  Thank you! I've done a few test scenarios to eliminate any known causes, however, AFX will still not accept base64 encoded string. Is there anyway this could be tested from your end? Could you provide an example?
  
  From the linux command line, I created a ldif file and executed a ldapmodify command using the base64 encoded string to test access permissions on the service account. This work well - here is a string which is to allow login always.
  
  logonHours:: ////////////////////////////
  
  Examples of (working) base64:
  allow login always: //////////////////////////// allow login never: AAAAAAAAAAAAAAAAAAAAAAAAAAAA 9 to 5 on Monday through Friday: AAAAAAD/AAD/AAD/AAD/AAD/AAAA
  
  Screen shot:
  
  Thanks in advance, Andrew
  Like • Show 0 Likes0
  Actions
  - Pradeep Kadambar @ Andrew Beauchamp on Apr 5, 2018 10:45 AM
    Mark Correct
    Correct Answer
    I would check with something like a Apache Directory Studio to manually add this attribute to an existing account.
    Like • Show 0 Likes0
    Actions
    - Andrew Beauchamp @ Pradeep Kadambar on Apr 5, 2018 8:02 PM
      Mark Correct
      Correct Answer
      Hello Pradeep,
      
      Thanks again. I used Apache Directory Studio to update the attribute using the LDIF file and got the a simillar error.
      
      My gut feel is with the java ldap library, it is not encoding it correctly or may have something to do with attribute name.
      
      The method of approach was:
      
      1. Export the account in full as an LDIF file. Interesting to note, the LDIF export showed the logonHours attribute value as a base64 and the display name as "logonHours:: ////////////////////////////" note the double colon
      
      2. I've modified the value and import it back into AD the the failed.
      
      Error while importing LDIF
      - [LDAP: error code 53 - 0000209A: SvcErr: DSID-031A1081, problem 5003 (WILL_NOT_PERFORM), data
      javax.naming.OperationNotSupportedException: [LDAP: error code 53 - 0000209A: SvcErr: DSID-031A1081, problem 5003 (WILL_NOT_PERFORM), data 0
      
      ; remaining name 'CN=Andrew Beauchamp,OU=Users,OU=AUS,DC=transurban,DC=com,DC=au'
      at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source)
      at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)
      at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)
      at com.sun.jndi.ldap.LdapCtx.c_createSubcontext(Unknown Source)
      at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_createSubcontext(Unknown Source)
      at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.createSubcontext(Unknown Source)
      at org.apache.directory.studio.connection.core.io.jndi.JNDIConnectionWrapper$4.run(JNDIConnectionWrapper.java:669)
      at org.apache.directory.studio.connection.core.io.jndi.JNDIConnectionWrapper.runAndMonitor(JNDIConnectionWrapper.java:1304)
      at org.apache.directory.studio.connection.core.io.jndi.JNDIConnectionWrapper.checkConnectionAndRunAndMonitor(JNDIConnectionWrapper.java:1237)
      at org.apache.directory.studio.connection.core.io.jndi.JNDIConnectionWrapper.createEntry(JNDIConnectionWrapper.java:722)
      at org.apache.directory.studio.ldapbrowser.core.jobs.ImportLdifRunnable.importLdifRecord(ImportLdifRunnable.java:465)
      at org.apache.directory.studio.ldapbrowser.core.jobs.ImportLdifRunnable.importLdif(ImportLdifRunnable.java:272)
      at org.apache.directory.studio.ldapbrowser.core.jobs.ImportLdifRunnable.run(ImportLdifRunnable.java:218)
      at org.apache.directory.studio.connection.core.jobs.StudioConnectionJob.run(StudioConnectionJob.java:109)
      at org.eclipse.core.internal.jobs.Worker.run(Worker.java:55)
      
      [LDAP: error code 53 - 0000209A: SvcErr: DSID-031A1081, problem 5003 (WILL_NOT_PERFORM), data 0
      Like • Show 0 Likes0
      Actions

Jayson Abrams Apr 5, 2018 2:58 PM

Also something to consider is using an SSH/PowerShell AFX Connector and calling this via PowerShell script.

if (-not (Get-Module ActiveDirectory)){            
  Import-Module ActiveDirectory            
}     

## allow logon 8am - 6pm Monday to Friday            
[byte[]]$hours = @(0,0,0,0,255,3,0,255,3,0,255,3,0,255,3,0,255,3,0,0,0)            
            
"`nMicrosoft"            
$name = "UserA"            
Get-ADUser -Identity $name |            
Set-ADUser -Replace @{logonhours = $hours}

1 person found this helpful

Actions

Andrew Beauchamp @ Jayson Abrams on Apr 5, 2018 8:04 PM
Mark Correct
Correct Answer
Thanks Jayson. This is quite creative.

Due to tight timeframes of the project I'm working on I won't be able to setup an interface like this in time.

I'm thinking of using the local linux ldapmodify command with a shell script to execute as a workaround.

Andrew
Like • Show 0 Likes0
Actions

Jayson Abrams Apr 6, 2018 1:17 PM

Try sending this instead of the Base64. As i think AD is defaulting to hexadecimal.

8AM to 6PM

0,0,0,0,255,3,0,255,3,0,255,3,0,255,3,0,255,3,0,0,0

1 person found this helpful

Actions

Andrew Beauchamp @ Jayson Abrams on Apr 8, 2018 8:42 PM

Thank again. However not dice.

You gave me the idea that rather try and guess the appropriate format I changed one of the AD collectors to try and collect this field (attribute) and see how it is displayed. Unfortunately, it resulted in a stacktrace error. I'm now lead to believe this product does not handle this AD attribute.

Product Enhancement might be on the cards here.....?

Here is the stack trace:

Collector test failed:
org.apache.xmlbeans.XmlException: error: Illegal XML character: 0x0 org.apache.xmlbeans.impl.piccolo.io.IllegalCharException: Illegal XML character: 0x0 at org.apache.xmlbeans.impl.piccolo.xml.XMLReaderReader.read(XMLReaderReader.java:169) at org.apache.xmlbeans.impl.piccolo.xml.PiccoloLexer.yy_refill(PiccoloLexer.java:3474) at org.apache.xmlbeans.impl.piccolo.xml.PiccoloLexer.yylex(PiccoloLexer.java:3958) at org.apache.xmlbeans.impl.piccolo.xml.Piccolo.yylex(Piccolo.java:1290) at org.apache.xmlbeans.impl.piccolo.xml.Piccolo.yyparse(Piccolo.java:1400) at org.apache.xmlbeans.impl.piccolo.xml.Piccolo.parse(Piccolo.java:714) at org.apache.xmlbeans.impl.store.Locale$SaxLoader.load(Locale.java:3439) at org.apache.xmlbeans.impl.store.Locale.parse(Locale.java:706) at org.apache.xmlbeans.impl.store.Locale.parseToXmlObject(Locale.java:690) at org.apache.xmlbeans.impl.store.Locale.parseToXmlObject(Locale.java:677) at org.apache.xmlbeans.impl.schema.SchemaTypeLoaderBase.parse(SchemaTypeLoaderBase.java:208) at com.aveksa.schema.system.AccountDataDocument$Factory.parse(AccountDataDocument.java:293) at com.aveksa.server.core.AccountDataCollector.getTestAccountData(AccountDataCollector.java:379) at com.aveksa.gui.objects.collector.account.GuiAccountDataCollector.getTestAccountData(GuiAccountDataCollector.java:157) at com.aveksa.gui.pages.admin.collector.account.test.TestAccountCollDialogView.printContent(TestAccountCollDialogView.java:26) at com.aveksa.gui.pages.base.view.DialogPageView.makeContent(DialogPageView.java:134) at com.aveksa.gui.pages.base.view.DialogPageView.handleRequest(DialogPageView.java:34) at com.aveksa.gui.pages.base.data.PageData.drawView(PageData.java:131) at com.aveksa.gui.pages.base.data.PageData.handleRequest(PageData.java:113) at com.aveksa.gui.pages.base.data.dialog.EditableDialogPageData.handleRequest(EditableDialogPageData.java:69) at com.aveksa.gui.pages.PageManager.forwardRequest(PageManager.java:577) at com.aveksa.gui.pages.PageManager.handleRequest(PageManager.java:341) at com.aveksa.gui.pages.PageManager.handleRequest(PageManager.java:272) at com.aveksa.gui.core.MainManager.handleRequest(MainManager.java:176) at com.aveksa.gui.core.MainManager.doGet(MainManager.java:125) at javax.servlet.http.HttpServlet.service(HttpServlet.java:687) at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:130) at com.aveksa.gui.core.filters.LoginFilter.doFilter(LoginFilter.java:53) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:132) at com.aveksa.gui.util.security.XSSFilter.doFilter(XSSFilter.java:20) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:132) at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:85) at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:61) at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131) at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:56) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.security.handlers.AuthenticationConstraintHandler.handleRequest(AuthenticationConstraintHandler.java:51) at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:45) at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:63) at io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.handleRequest(ServletSecurityConstraintHandler.java:56) at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:58) at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:70) at io.undertow.security.handlers.SecurityInitialHandler.handleRequest(SecurityInitialHandler.java:76) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:261) at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:247) at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:76) at io.undertow.servlet.handlers.ServletInitialHandler$1$1.run(ServletInitialHandler.java:172) at java.security.AccessController.doPrivileged(Native Method) at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:169) at io.undertow.server.Connectors.executeRootHandler(Connectors.java:197) at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:759) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) at java.lang.Thread.run(Thread.java:745)

Actions

Sajith Mani Aug 13, 2018 11:06 AM
Mark Correct
Correct Answer
Is this issue resolved? I am facing the exactly same issue. Can you please let me know what was the solution for this issue?
Like • Show 0 Likes0
Actions
- Andrew Beauchamp @ Sajith Mani on Aug 13, 2018 11:06 PM
  Mark Correct
  Correct Answer
  Hello Sajith.
  This issue was not resolved by the RSA G&L LDAP AFX Connector.
  
  From the short time playing around with the LDAP connector, it's looks like it is a limitation of the underlying Novel LDAP driver. It can not deal with the type OctetString.
  
  As a work around, I created a new AFX SSH connector which connects to the IAM server and passes the parameters to a shell script that uses the native ldapmodify linux command. This command line can accept base64 values to modify this attribute
  Like • Show 1 Like1
  Actions

AFX - Active Directory Update Attribute "logonHours" how?

Outcomes

Related Content

Recommended Content