Configuring AD accountExpires Attribute via Policy Xpress: Identity Manager

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

This article provides the required syntax and procedural approach for managing the Active Directory (AD) accountExpires attribute using Identity Manager Policy Xpress (PX). It addresses common "invalid date syntax" errors encountered during date calculation or modification tasks.

Environment

Identity Manager 14.5 & 15

Cause

The error "invalid date syntax" occurs when the PX UI attempts to interpret AD date strings that do not match the expected format of yyyy-MM-ddTHH:mm:ss.SSS. Attempting direct date arithmetic (e.g., adding days to a date string) within the PX UI often fails to preserve this format.

Resolution

To successfully update the accountExpires attribute using Policy Xpress:

1. Calculate the Date Externally: Perform date arithmetic (such as adding 30 days to a current date) using a Business Logic Task Handler (BLTH) or an external script.
2. Format the Output: Ensure the resulting date is passed to the PX as a string formatted strictly as yyyy-MM-ddTHH:mm:ss.SSS.
3. Configure the PX:
   1. Open the Identity Manager Management Console.
   2. Navigate to Policy Xpress.
   3. Configure the PX of type UI to fetch the current accountExpires value from the AD endpoint.
   4. Input the formatted date string generated in Step 1 into the target attribute field.
   5. Save and validate the PX configuration within the environment.

Note: Ensure the source data feeding the PX is validated for format consistency before the write operation to the AD endpoint.

Additional Information

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.