Administrative Logout and Password last changed

[Elle Weintraub]

There's actually a better attribute to use:
msDS-UserPasswordExpiryTimeComputed

That gives you when the password will expire and accounts for different password policies you may have in your environment.

Here is also some Perl Code I made to return a hash that translates it from MS's Epoch to standard formats:

sub convertDate {
 my $adDate = shift;
 my $timecheck = int(($adDate-116444736000000000)/10000000);
 my $time = time;
 my ($sec,$min,$hour,$mday,$mon,$year19,$wday,$yday,$isdst) = localtime($timecheck);
 my @localt = localtime($timecheck);
 if ($isdst == 1) { ($sec,$min,$hour,$mday,$mon,$year19,$wday,$yday,$isdst) = localtime($timecheck-3600);  @localt = localtime($timecheck-3600); }
 my $offsetsecs = timegm(@localt) - timelocal(@localt);
 my $offsethours = $offsetsecs/3600;
 my $offsetprefix = "";
 if (($offsethours > -10) && ($offsethours < 10)) { $offsetprefix = "0"; }
 if ($offsethours < 0) { $offsetprefix = "-" . $offsetprefix; $offsethours *= -1; } else { $offsetprefix = "+" . $offsetprefix; }
 my $offset = $offsetprefix . $offsethours . "00";
 my $year2k = $year19+1900;
 $mon = $mon+1;
 if ($mon < 10) { $mon = "0$mon"; }
 if ($mday < 10) { $mday = "0$mday"; }
 if ($hour < 10) { $hour = "0$hour"; }
 if ($min < 10) { $min = "0$min"; }
 if ($sec < 10) { $sec = "0$sec"; }
 my $ampm = "am";
 if ($hour > 11) { $ampm = "pm"; if ($hour > 12) { $hour = $hour-12; }}
 if (length($hour) < 2) { $hour = "0$hour"; }
 if ($year2k > 9999) { $year2k = 9999; }
 my $readableDate = "$mon/$mday/$year2k at $hour:$min:$sec $ampm";
 my %dateData = ();
 my %date = ();
 $date{'sec'} = $sec;
 $date{'min'} = $min;
 $date{'hour'} = $hour;
 $date{'day'} = $mday;
 $date{'month'} = $mon;
 $date{'year'} = $year19;
 $date{'wday'} = $wday;
 $date{'yday'} = $yday;
 $date{'dst'} = $isdst;
 my $ldapString = "$year2k$mon$mday$hour$min$sec$offset";
 $dateData{'dateString'} = $readableDate;
 $dateData{'perlTime'} = $timecheck;
 $dateData{'ldapString'} = $ldapString;
 $dateData{'date'} = %date;
 return \%dateData;
}


-Elle Weintraub

Enterprise IT Architect

Enterprise Authentication Team Lead

Enterprise Authentication & Cloud Workspace

IT at Johns Hopkins

Johns Hopkins at Mt. Washington

5801 Smith Ave.

Davis Building Suite 3110B

Baltimore, MD 21209

E-mail: eweintra at jhmi.edu<mailto:eweintra at jhmi.edu>

Pronouns: She, Her, Hers



[cid:ffd3fe38-862d-4922-b0a5-b8135fd9c18b]



________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott via users <users at shibboleth.net>
Sent: Tuesday, February 11, 2025 8:25 AM
To: Shib Users <users at shibboleth.net>
Cc: Cantor, Scott <cantor.2 at osu.edu>
Subject: Re: Administrative Logout and Password last changed


      External Email - Use Caution



> We are also wondering if it's possible to use an attribute such
> as passwordLastSet from AD? It's not epoch but would that
> qualify for the Dates time spec in use?

There is no spec, you supply the formatting string to parse it with.

-- Scott


--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250211/0d8f66ab/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-nlgeczlj.gif
Type: image/gif
Size: 5481 bytes
Desc: Outlook-nlgeczlj.gif
URL: <http://shibboleth.net/pipermail/users/attachments/20250211/0d8f66ab/attachment.gif>