New User Created - immediately invalid

[snowfire20]

Hi. I've been testing the Sdk with our 9.02 Secureauth site, and have been seeing an issue with creating new users. I create the user with just a few properties and a username and password. I then validate that user using the ValidatePasswordRequest with the users name and password.
The new user is always invalid.
I ran a quick test the the CreateUserTest from the sdk unit tests and got the same results. any idea whats going on?

[jhickmansa]

Hello @snowfire20,

Can you tell me what your data tab configuration is set to? What data store type are you using (Active Directory, SQL, etc)? If SQL, what password type? If AD, does the service account you are using have the correct permissions to create users in AD?

Let me know and I will see if we can't get to the bottom of it.

-Jeff Hickman

[snowfire20]

hi @jhickmansa,
we are using an Active Directory datastore (searchFilter: (&(samAccountName=%v)(objectclass=*))).
Yes, the user has permissions to create users. that comes back with a success message. If I go to that realms forgot password page, that user can reset their password without issue, and then log in. they cannot log in through the realms page with the password they were created with.

group settings:
Advanced AD User Check: false
Validate User Type: Search 
User Group Check Type: Allow Access 
User Groups:
Include Nested Groups: false
Max Invalid Password Attempts: 10

The active Directory is configured that the User is marked as "must change password at next login"
this is something that we want to use, as we want the user to be forced to change their password after they log in through the secureauth realm.

[jhickmansa]

The "must change password at next login" flag is where your issue is at. With this flag, we see that the user's password is in an "untrusted" state, specifically Active Directory changes the UAC from a "Normal" account to one that has a flag indicating that this setting is on. The API does not have context to prompt the user for a password change, however the SecureAuth realm can with the inline password change box found on the workflow section of the realm.

[snowfire20]

in that case the error returned needs changed. its currently returning invalid, it needs to return an indicator that the user must change their password. The documentation needs updated as well, this behavior is not mentioned anywhere.
I would argue that this method needs renamed or split into two methods. ValidatePasswordRequest to me means you are validating the password only. that they must change their password is a workflow that is unrelated to the validity of the password, and I can get it from querying the profile setting if that's what I was looking for.