Helpdesk "Password Expires"

Question

We have a pretty generic installation of Adaxes 2013.1.
We'd like the HelpDesk to be able to see the Password Expiration date. Currently they see "Password Expires N/A " when the password expriation date is set for a given user.

If we assign the "Account Manager" builtin security role to the HelpDesk group then we get the desired display, for example:
"Password Expires Expires in: 224 days (4/2/2014 5:45:39 PM) "
But we cannot grant that role to the HelpDesk.

We tried granting Property-specific permissions to HelpDesk: "Read 'PasswordExpires' Property" and "Read 'PasswordExpiresDaysLeft' Property" but that made no difference.

What should we do to enable this field for viewing by the HelpDesk?

Below is what we have for permissions in the builtin HelpDesk role:
Builtin Help Desk Role
Deny Execute All Custom Commands User
Allow Read All object types
Allow Read Group
Allow Read 'Admin Comment' Property User
Allow Read 'Password Last Set' Property User
Allow Reset Password User
Allow Send SMS User
Allow Write 'Account Expires' Property User
Allow Write 'Account Options' Property User
Allow Write 'Admin Comment' Property User
Allow Write 'Lockout-Time' Property User
Allow Write 'Password Last Set' Property User
Allow Write 'User Cannot Change Password' Property User

Answer 1

Hello,

To view in how many days a user's password will expire, you Help Desk needs to be able to view the Password Policy applied to the user. Otherwise, it is impossible to determine for how long a password remains valid.

If you don't use Fine-Grained Password Policies for your domain, you need to grant your Help Desk the right to view the domain object. Since your Security Role already includes the right to Read All object types, you don't need to grant any additional permissions. You simply need to correctly assign the Role by including the domain object in the Activity Scope of the Role. To do this:

1. Launch Adaxes Administration Console.
2. Navigate to and select your Help Desk Role. The Permissions and Assignments of the Role will be displayed in the Result Pane (located to the right).
3. Right-click in the Assignments section and click Add Assignment.
   
4. In the dialog box that appears, select the users and/or groups from your Help Desk.
5. Click OK.
6. In the dialog box that appears, double-click your domain.
7. In the Assignment Options dialog box that appears, select the This Domain object option and unselect the All objects in this Domain option. Thus, you will grant your Help Desk the permission to read the domain object only.
   
8. Click OK two times and save the Security Role.

If you use Fine-Grained Password Policies for your domain, you need to grant your Help Desk the right to view the container that stores Fine-Grained Password Policies. The Distinguished Name (DN) of the container is CN=Password Settings Container,CN=System,DC=domain,DC=com, where DC=domain,DC=com is the DN of your domain. Since your Security Role already includes the right to Read All object types, you don't need to grant any additional permissions. You simply need to correctly assign the Role by including the container for Fine-Grained Password Policies and all of its children in the Activity Scope of the Role. To do this:

1. Launch Adaxes Administration Console.
2. Navigate to and select your Help Desk Role. The Permissions and Assignments of the Role will be displayed in the Result Pane (located to the right).
3. Right-click in the Assignments section and click Add Assignment.
   
4. In the dialog box that appears, select the users and/or groups from your Help Desk.
5. Click OK.
6. In the dialog box that appears, expand the Object Types drop-down list.
7. Select the Show all object types option.
8. Select the ms-DS-Password-Settings-Container object type.
   
9. Double click the container with Distinguished Name CN=Password Settings Container,CN=System,DC=domain,DC=com.
10. In the Assignment Options dialog box that appears, select to assign the Security Role over the container object itself and all of its children.
    
11. Click OK two times and save the Security Role.