SSO Extension password expiration

[marcelhacker]

Hey Jamf community, 

I hope someone can help me with our problem with the SSO Extension.

We have replaced Enterprise Connect with Kerberos SSO Extension and now we have the problem that the password expiration date is not taken from Active Directory.
We only get the message "Password doesn't expire".

All other functions like change password work without problems.

Does anyone know the problem and has a solution for this?

thankful for any help 🙂 

best regards

Marcel

[Wilson25]

 Apple IT admin's guide to Kerberos: SSO Extension, what's new with Big ... “Change Password” or interact with a password expiration notice.

Rapidfs Login

[marcelhacker]

Hey Wilson,

thanks for your replay but I can't find any solution for it =/

[spotmac]

@marcelhacker i checked this on my side and it works fine in macOS12. Do you double checked all dns entries from your active directory (service records)?

[jtrant]

This works for me as advertised. Is the AD account in question set to "Password never expires" by any chance? Is this affecting all users in your org?

[marcelhacker]

Hey all thanks for your replays. 

we checked everything on AD and the account isn't set to "password never expires".

But the problem was solved by updating to macOS12 👍

thank you and best regards

Marcel

[cc_rider]

Hi all, 

Funny thing - I've changed my password yesterday through this SSO Extension and I've got the same problem as Marcel ("Password doesn't expire" message). Yes, I'm still under Big Sur and at the time of this password change, it was 11.6.0...I went ahead with the update to 11.6.1, just to see if it will fix it, but it didn't (we are still running some tests with Monterey, before we'll make it available for the majority). Any thoughts, suggestions, other than the Monterey's upgrade?

Thanks,

CC

[marcelhacker]

Hey all,

our solution was to add a AD Site to the configuration in Jamf.

best regards

Marcel

[RCRC74]

Can you please expand on this? Why would you need to add an AD site and how you did it to get the "Password doesn't expire message" to go away, thanks