When NS8 lists users from a remote Active Directory, some accounts that never had a password set show a wrong password expiration date, far in the past instead of a neutral value.
To Reproduce
- Connect NS8 to a remote AD domain that has at least one account whose password was never set (or one flagged "must change password at next login").
- Run:
api-cli run list-domain-users --data '{"domain":"<your-domain>"}'
- Check the "password expiration" value returned for that account.
Expected behavior
For an account with no password set, password_expiration should be -1, not a real date. The UI code that reads this value has been checked and already handles -1 correctly, so no further UI changes are needed.
Actual behavior
The tool returns a nonsense date, for example:
"password_expiration": -11636697600
Active Directory uses a special marker to mean "no password set yet," but NS8 treats it as a real date and calculates from it anyway.
Components
NS8 core 3.21.1
Additional context
Found while investigating the related krbtgt_AzureAD issue (#8151).
When NS8 lists users from a remote Active Directory, some accounts that never had a password set show a wrong password expiration date, far in the past instead of a neutral value.
To Reproduce
api-cli run list-domain-users --data '{"domain":"<your-domain>"}'Expected behavior
For an account with no password set,
password_expirationshould be-1, not a real date. The UI code that reads this value has been checked and already handles-1correctly, so no further UI changes are needed.Actual behavior
The tool returns a nonsense date, for example:
Active Directory uses a special marker to mean "no password set yet," but NS8 treats it as a real date and calculates from it anyway.
Components
NS8 core 3.21.1
Additional context
Found while investigating the related krbtgt_AzureAD issue (#8151).