[Virtual attributes on User form] Populate virtual attribute values, when user form is opened

Hello,
I have the following business scenario: When 'User form' is opened within Active Roles, then couple of virtual attributes (e.g.: badPasswordTime, lastLogonTimestamp -> INTEGER8 types) should be populated with their recent values (taken from Primary Domain Controller emulator).
Unfortunately, tried solution, which is based on the following article (www.oneidentity.com/.../last-bad-password-time) does not work. It throws the following error: Recursion is too deep; nested policy execution limit has been exceeded
From my testing, mentioned error is occurring on SetInfo method (whether it's DirObject or objUser defined in my script). ARS best practices article (www.oneidentity.com/.../ars-script-policy-best-practices) suggests to use Request.Put method instead. However, it looks, that Request.Put method would not work under onPreGet event.
Therefore I am looking for some solution, which will still allow me to use onPreGet event (opening User form event), which will set virtual attribute value during the load without ending in infinity loops. See my scripts below for your reference.
Many thanks in advance

VBScript:

Sub onPreGet(Request)
    'continue with flow only on User form    
    If Request.Class <> "user" Then Exit Sub
    
    'verification of requested attributes
    If Request.IsAttributeRequested("AccountingCode") = False Or Request.IsAttributeRequested("sAMAccountName") = False Then
        Exit Sub
    End If

    Logit "Entered script"
    Dim strPDCEmulator: strPDCEmulator = EnumeratePDCEmulator
    Dim objUser: Set objUser = GetObject("LDAP://" & strPDCEmulator & "/" & Request.Get("distinguishedName"))
    Set objLargeInteger = CreateObject("AelitaEDM.EDMLargeInteger")

    ' Specify badPasswordTime as custom date = 6 months from current date
    badPwdTimeAttr = DateAdd("m", 6, Now)
    objLargeInteger.SetDate(badPwdTimeAttr)
    Logit "Logit badPwdTimeAttr -> " & CStr(badPwdTimeAttr)
    Logit "Logit badPwdTimeAttr GetString -> " & objLargeInteger.GetString

    On Error Resume Next
    Set objUser = GetObject("EDMS://" & Request.Get("distinguishedName"))
    objUser.Put "edsvaBadPasswordTime", objLargeInteger.GetIADsLargeInteger
    objUser.SetInfo
    If Err.Number <> 0 Then
        Logit "Set info failed -> " & Err.Description
        Err.Clear
    End If 
    Set objUser = Nothing

    Logit "Finished script"
    
End Sub

Sub Logit(inputString)

    Dim inputPath: inputPath = "C:\TEMP\last_logon_bad_password\ScriptLogVB.txt"
    Dim dateTimeNow: dateTimeNow = FormatDateTime(Now)
    Set fso = CreateObject("Scripting.FileSystemObject")
    Set MyFile = fso.OpenTextFile(inputPath , 8, True)
    MyFile.WriteLine(dateTimeNow + " -> " + inputString)
    MyFile.Close

End Sub


Private Function EnumeratePDCEmulator()

    Dim objRootDSE, objDomain, strPDCEmulator, objNtds, objComputer
    Set objRootDSE = GetObject("LDAP://rootDSE")
    Set objDomain = GetObject("LDAP://" & objRootDSE.Get("defaultNamingContext"))
    strPDCEmulator = objDomain.Get("fSMORoleOwner")
    Set objNtds = GetObject("LDAP://" & strPDCEmulator)
    Set objComputer = GetObject(objNtds.Parent)
    
    EnumeratePDCEmulator = objComputer.dNSHostName
    
    Set objComputer = Nothing
    Set objNtds = Nothing
    Set objDomain = Nothing
    Set objRootDSE = Nothing

End Function

Log file, which is generated during opening User form, when VBScript was triggered:

2/5/2021 10:32:22 AM -> Entered script
2/5/2021 10:32:22 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:22 AM
2/5/2021 10:32:22 AM -> Logit badPwdTimeAttr GetString -> 132726331420000000
2/5/2021 10:32:23 AM -> Entered script
2/5/2021 10:32:23 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:23 AM
2/5/2021 10:32:23 AM -> Logit badPwdTimeAttr GetString -> 132726331430000000
2/5/2021 10:32:23 AM -> Entered script
2/5/2021 10:32:23 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:23 AM
2/5/2021 10:32:23 AM -> Logit badPwdTimeAttr GetString -> 132726331430000000
2/5/2021 10:32:23 AM -> Entered script
2/5/2021 10:32:23 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:23 AM
2/5/2021 10:32:23 AM -> Logit badPwdTimeAttr GetString -> 132726331430000000
2/5/2021 10:32:23 AM -> Entered script
2/5/2021 10:32:23 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:23 AM
2/5/2021 10:32:23 AM -> Logit badPwdTimeAttr GetString -> 132726331430000000
2/5/2021 10:32:23 AM -> Entered script
2/5/2021 10:32:23 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:23 AM
2/5/2021 10:32:23 AM -> Logit badPwdTimeAttr GetString -> 132726331430000000
2/5/2021 10:32:24 AM -> Entered script
2/5/2021 10:32:24 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:24 AM
2/5/2021 10:32:24 AM -> Logit badPwdTimeAttr GetString -> 132726331440000000
2/5/2021 10:32:24 AM -> Finished script
2/5/2021 10:32:24 AM -> Finished script
2/5/2021 10:32:24 AM -> Finished script
2/5/2021 10:32:25 AM -> Finished script
2/5/2021 10:32:25 AM -> Finished script
2/5/2021 10:32:25 AM -> Finished script
2/5/2021 10:32:25 AM -> Finished script
2/5/2021 10:32:25 AM -> Entered script
2/5/2021 10:32:25 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:25 AM
2/5/2021 10:32:25 AM -> Logit badPwdTimeAttr GetString -> 132726331450000000
2/5/2021 10:32:26 AM -> Entered script
2/5/2021 10:32:26 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:26 AM
2/5/2021 10:32:26 AM -> Logit badPwdTimeAttr GetString -> 132726331460000000
2/5/2021 10:32:26 AM -> Entered script
2/5/2021 10:32:26 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:26 AM
2/5/2021 10:32:26 AM -> Logit badPwdTimeAttr GetString -> 132726331460000000
2/5/2021 10:32:26 AM -> Entered script
2/5/2021 10:32:26 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:26 AM
2/5/2021 10:32:26 AM -> Logit badPwdTimeAttr GetString -> 132726331460000000
2/5/2021 10:32:26 AM -> Entered script
2/5/2021 10:32:26 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:26 AM
2/5/2021 10:32:26 AM -> Logit badPwdTimeAttr GetString -> 132726331460000000
2/5/2021 10:32:26 AM -> Entered script
2/5/2021 10:32:26 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:26 AM
2/5/2021 10:32:26 AM -> Logit badPwdTimeAttr GetString -> 132726331460000000
2/5/2021 10:32:27 AM -> Entered script
2/5/2021 10:32:27 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:27 AM
2/5/2021 10:32:27 AM -> Logit badPwdTimeAttr GetString -> 132726331470000000
2/5/2021 10:32:27 AM -> Entered script
2/5/2021 10:32:27 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:27 AM
2/5/2021 10:32:27 AM -> Logit badPwdTimeAttr GetString -> 132726331470000000
2/5/2021 10:32:27 AM -> Set info failed -> Administrative Policy returned an error.
Recursion is too deep; nested policy execution limit has been exceeded.


2/5/2021 10:32:27 AM -> Finished script
2/5/2021 10:32:27 AM -> Finished script
2/5/2021 10:32:27 AM -> Finished script
2/5/2021 10:32:28 AM -> Finished script
2/5/2021 10:32:28 AM -> Finished script
2/5/2021 10:32:28 AM -> Finished script
2/5/2021 10:32:28 AM -> Finished script
2/5/2021 10:32:28 AM -> Finished script
2/5/2021 10:32:29 AM -> Entered script
2/5/2021 10:32:29 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:29 AM
2/5/2021 10:32:29 AM -> Logit badPwdTimeAttr GetString -> 132726331490000000
2/5/2021 10:32:29 AM -> Entered script
2/5/2021 10:32:29 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:29 AM
2/5/2021 10:32:29 AM -> Logit badPwdTimeAttr GetString -> 132726331490000000
2/5/2021 10:32:30 AM -> Entered script
2/5/2021 10:32:30 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:30 AM
2/5/2021 10:32:30 AM -> Logit badPwdTimeAttr GetString -> 132726331500000000
2/5/2021 10:32:30 AM -> Entered script
2/5/2021 10:32:30 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:30 AM
2/5/2021 10:32:30 AM -> Logit badPwdTimeAttr GetString -> 132726331500000000
2/5/2021 10:32:30 AM -> Entered script
2/5/2021 10:32:30 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:30 AM
2/5/2021 10:32:30 AM -> Logit badPwdTimeAttr GetString -> 132726331500000000
2/5/2021 10:32:30 AM -> Entered script
2/5/2021 10:32:30 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:30 AM
2/5/2021 10:32:30 AM -> Logit badPwdTimeAttr GetString -> 132726331500000000
2/5/2021 10:32:30 AM -> Entered script
2/5/2021 10:32:30 AM -> Logit badPwdTimeAttr -> 8/5/2021 10:32:30 AM
2/5/2021 10:32:30 AM -> Logit badPwdTimeAttr GetString -> 132726331500000000
2/5/2021 10:32:31 AM -> Finished script
2/5/2021 10:32:31 AM -> Finished script
2/5/2021 10:32:31 AM -> Finished script
2/5/2021 10:32:31 AM -> Finished script
2/5/2021 10:32:32 AM -> Finished script
2/5/2021 10:32:32 AM -> Finished script
2/5/2021 10:32:32 AM -> Finished script

Top Replies

sslovik over 4 years ago +1 suggested

hi JohnnyQuest, I was able to make it work, see the solution below:
1. Option "Store values of this virtual attribute in the Active Roles Administration database" for created virtual attributes is…

Parents

0 JohnnyQuest over 4 years ago

Couple of thoughts:

1) Powershell is now the "preferred" language for authoring policy scripts

2) I believe you could use a "Control" to suppress the error by setting the control the first time through your code and then looking for it. If it's set, then exit.

So something like this:

# Place at the top of your code

Try

{

$RecurseStop = $Request.GetinControl("StopRecursion")

If ($RecurseStop){return}

}

Catch

{

# Prevent errors before the Control is set

}

# Place at the end of your code

$Request.PutInControl("StopRecursion",$Constants.ADSTYPE_CASE_IGNORE_STRING,"1")
Cancel
Up 0 Down

Reply

Verify Answer

Cancel
0 Former Member over 4 years ago in reply to JohnnyQuest

sslovik can you confirm this is the requested string?
Cancel
Up 0 Down

Reply

Verify Answer

Cancel
0 sslovik over 4 years ago in reply to Former Member

hi , correct, this is proper requested question (thread) to keep open
can you please display (enable) my reply, which was given to this thread last week on Friday (5.Feb) ? thx
Cancel
Up 0 Down

Reply

Verify Answer

Cancel
0 Former Member over 4 years ago in reply to sslovik

that is not possible. please post it again here as a new reply and if you encounter any issues I will be available to assist
Cancel
Up 0 Down

Reply

Verify Answer

Cancel

Reply

0 Former Member over 4 years ago in reply to sslovik

that is not possible. please post it again here as a new reply and if you encounter any issues I will be available to assist
Cancel
Up 0 Down

Reply

Verify Answer

Cancel

Children

No Data