AccountExpires Approval Notification with a real date

Question

In the approval notification for when a users account expiration is changed, the client is wanting to show a date when the account will expire, or the number of days until the account expires. The problem is that if we add the AccountExpires attribute to the email message, the INT8 date/time is shown. We were able to get a Policy script to work to set a VA with a readable date, however, that only fires when the attribute gets changed, therefore it is not available for when the Approval notification is sent out. It did work once, but ALL subsequent execution did not occur. We add the calling of the script to the Workflow before the Approval, and it worked only once as well. We have attempted to use C# within the asp.net code of the notification, but this would not convert the Account Expires to a readable format either. 
 So, the question is, how do you get the Approval Notification to show the Account Expires in a readable format?

Terrance.Crombie · Accepted Answer

I worked with Rodney and discovered something useful which was previously undocumented. This resolved his issue: 
 Title: Resolving a race condition between an Active Roles Policy and an Active Roles Approval Workflow Solution: 333398 URL: https://support.oneidentity.com/kb/333398

Terrance.Crombie · Answer

Hello Rodney, 
 As of right now, Active Roles requests the use of a script in order to convert from the Active Directory FileTime time format. 
 The actual script itself is extremely simple. You could use something like this in a Change Workflow: 
 
 function returnReadableAccountExpiresDate($Request)
{
 return [datetime]::fromfiletime($DirObj.accountExpires)
} 
 
 This could be used to populate a value to a stored custom Virtual Attribute in either an "Update" or "Modify requested changes" Workflow activity. This custom Virtual Attribute can then be embedded into your notification as a custom token. 
 Please let me know if you have any questions or concerns. 
 Regards, Terrance Crombie

Terrance.Crombie · Answer

I created a new Wiki post with information on how to populate a custom Virtual Attribute with a readable value using an Active Roles Policy Script: 
 (7) Populating a custom Virtual Attribute with a readable accountExpires timestamp using an Active Roles Policy Script - Wiki - Active Roles Community - One Identity Community

Endpoint Privilege Management

AccountExpires Approval Notification with a real date

Top Replies