title: Constructed attributes in Active Directory Global Catalog (get password expiry for accounts)
body: <p>Building a custom authentication service on top of Active Directory (using LDAP), we now need to see if an account's password is expired or not (and preferably also <em>when</em> the password expires/expired). We need to see this when querying for accounts (<strong>not</strong> at <code>bind()</code> in the context of a user request).</p>
  
  <p>There are several flags available in Active Directory for this. The first we tried was the <a href="http://msdn.microsoft.com/en-us/library/ms680832(v=vs.85).aspx" rel="nofollow">User-Account-Control</a> attribute, which has the bit <code>ADS_UF_PASSWORD_EXPIRED</code> which should be set if the password expires:</p>
  
  <blockquote>
    <p>The user password has expired. This flag is created by the system using data from the Pwd-Last-Set attribute and the domain policy.</p>
  </blockquote>
  
  <p>We couldn't get it to work, and found <a href="http://www.selfadsi.org/ads-attributes/user-userAccountControl.htm#UF_PASSWORD_EXPIRED" rel="nofollow">SimpleADSI</a>'s explanation:</p>
  
  <blockquote>
    <p>Caution: This bit does not work as expected!</p>
    
    <p>Normally, this user account control bit is supposed to indicate that the user's password is expired. However, it is not set by the system when the password actually expires, nor can you force the user to change his password at the next logon by setting this bit.</p>
  </blockquote>
  
  <p>They instead refer to the <a href="http://www.selfadsi.org/deep-inside/attribute-constructed.htm" rel="nofollow">constructed attribute</a> <a href="http://msdn.microsoft.com/en-us/library/ms677840(v=vs.85).aspx" rel="nofollow">msDS-User-Account-Control-Computed</a> which also contains a bit for checking password expiry: <code>UF_PASSWORD_EXPIRED</code>. There is also the <a href="http://msdn.microsoft.com/en-us/library/cc223410.aspx" rel="nofollow">msDS-UserPasswordExpiryTimeComputed</a>, another constructed attribute, for getting when in time the password expires. Perfect, with one caveat:</p>
  
  <blockquote>
    <p>Constructed Attributes cannot be returned as value data in an LDAP search request. unless the search scope is set to "base" which means that the LDAP client accesses only one single object.</p>
  </blockquote>
  
  <p>This means we had to do one additional query for each account to fetch the constructed attributes. Not ideal, but it works.</p>
  
  <p>Next, more Active Directory domains in the forest also wanted to use the new custom authentication service, so instead of querying our local domain controller we started querying the Active Directory Global Catalog (which means we can query for objects in any domain in the same forest).</p>
  
  <p>And <strong>to the problem</strong> (finally): the Global Catalog does not synchronize all attributes from the local domain controller. "Luckily" the non-working User-Account-Control attribute is synchronized (oh the irony), but the constructed attributes we are using are not. This means we are back to square one, and cannot get when or even if the password has expired for accounts.</p>
  
  <p>So, the two main questions are:</p>
  
  <ol>
  <li>Is there any way to enable synchronization of the constructed attributes (or the values they are calculated from) to the Active Directory Global Catalog?</li>
  <li>Is there a better way, perhaps to avoid the single-object-querying we do (did) for fetching the constructed attributes (I guess I am trying to ask if we are doing it all wrong...)?</li>
  </ol>
  
  <p>Thanks in advance!</p>