HowTo programmatically set the Account Never Expires check box.

[Mark Stewart]

I need to know how to check the Account Never Expires checkbox for the admin user.

After upgrade to GW 10.0-CR04 we have our admin account expiring. (checkbox unchecked)

Need to know how to programmatically on CLI or in MySQL to check this box so the expired account will work again w/o logging into Policy Manager over and over to unlock. 

I figured out how to reset the fail_count and set state ACTIVE or INACTIVE but cannot figure out where the Account Never Expires setting is stored.

Hints would be appreciated. 

Respectfully, 

Mark

[Mark Stewart]

No hints? 

I am going to create a support ticket for this if no one chimes in with suggestions. 

[Vince Baker]

internal_user -> expiration

Note below that I set my admin to "No Expiry", but my vbaker user to expire (and the date is actually past expiry)


mysql> select login,password_expiry,expiration from internal_user;
+--------+-----------------+---------------+
| login | password_expiry | expiration |
+--------+-----------------+---------------+
| admin | 1661962713230 | -1 |
| vbaker | 1663058836736 | 1655275640543 |
+--------+-----------------+---------------+
2 rows in set (0.01 sec)

------------------------------
Principal Architect
Apiida AG
https://www.apiida.com
------------------------------

[Mark Stewart]

Vince,

Thank you. Your hints got me to the correct table. 

I new it could be done. Didn't see that table and setting. 

Got it working in a few minutes.

Now to off automate it in Ansible :D 

Thanks again. 

[William Forsyth]

Hi Mark:

Glad you were able to resolve this way, thanks Vince for input.  You can also manage users with Layer 7 RESTMan API interface but I have not done this previously so not sure if you can update the expiry flag.  The release should not reset this field in my mind so I think a Case is warranted and someone should take a look at it. 

Regards, Alex.

------------------------------
Solution Architect - Security & Integration
Broadcom Software Division,
Vancouver, B.C. Canada
------------------------------

[Mark Stewart]

Thanks William,

Want to drop a hint about the expiry flag reset if someone researches the issue. 

We have renamed the admin account and that was the admin account that was locked. Admin account not named admin any longer.

Not positive if it is just related to accounts not named admin but thought I would give you that piece of info to help investigate why the checkbox was reset. 

Thanks again to all. 

Mark 

[Aran White]

The support ticket is the way, going straight to the database may work but might be something we cant support and something that gets you into trouble during an upgrade or patch.

------------------------------
Aran White - [JobTitle]
[CompanyName]
[State]
------------------------------

[Vince Baker]

Hi,

As you've had no luck with other ways I would say the quick and dirty way is to just set the Never Expires field in the SSG database directly. I can't see it will do any harm.

Regards

Vince

------------------------------
Principal Architect
Apiida AG
https://www.apiida.com
------------------------------