ADFS: Wrong number of days for password expiration

techguy 6

Hi there,

we've configured the password expiry claim in our ADFS like this: https://video2.skills-academy.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-to-send-password-expiry-claims

And our users are getting messages like this, which is confusing:

Microsoft Outlook
Your password for "username@business.biz" expires in 1217021 days. Click here to change your password."

Do you have any ideas, where this high amount of days comes from?

Thanks.

Pierre Audonnet - MSFT 10,191 Reputation points Microsoft Employee

2020-10-06T13:43:33.987+00:00

Have you set up the Claims X-Ray Relying Party Trust in your ADFS? If not, I would recommend you to do so, then set the same rule on the Claims X-Ray that you have set on the Azure AD Relying Party Trust and test the access. It will tell you what in your token, like:

Then we know if the issue is at the ADFS level or somewhere else.
techguy 6 Reputation points

2020-10-19T07:25:26.347+00:00

Thank you very much for sharing the ClaimsXray help site. Didn't know this exists. I was able to receive a x-ray claim, but it didn't include the passwordexpirationtime attribute. But I'll do some more testing.
Pierre Audonnet - MSFT 10,191 Reputation points Microsoft Employee

2020-10-19T17:18:54.177+00:00

It will show only if it is 14 days away or less to expire.
techguy 6 Reputation points

2020-10-20T08:27:23.103+00:00

Yes, I've read about this.

There is a 14 days window so the sent claims will only be populated if the password is expiring within 14 days.

For testing purposes: I've created a fine-grained password policy, set the max. password age to 10 days and linked this FGPP to a test user. But even in this case I didn't get the attributes.
Pierre Audonnet - MSFT 10,191 Reputation points Microsoft Employee

2020-10-20T11:00:15.61+00:00

Works for me in my lab (ADFS 2016 and ADFS 2019).
Can you copy/paste the rules you have?

Pierre Audonnet - MSFT 10,191 Microsoft Employee

In my lab, I have the following.

A user called TechGuy with an FGPP that tell the password expires after 7 days:

Get-ADUserResultantPasswordPolicy -Identity techguy


AppliesTo                   : {CN=techguy,OU=Accounts,DC=verenatex,DC=com}
ComplexityEnabled           : True
DistinguishedName           : CN=Exp7days,CN=Password Settings Container,CN=System,DC=verenatex,DC=com
LockoutDuration             : 00:30:00
LockoutObservationWindow    : 00:30:00
LockoutThreshold            : 0
MaxPasswordAge              : 7.00:00:00
MinPasswordAge              : 1.00:00:00
MinPasswordLength           : 7
Name                        : Exp7days
ObjectClass                 : msDS-PasswordSettings
ObjectGUID                  : 040967b3-e8c2-4d57-a793-bd1bb7409228
PasswordHistoryCount        : 24
Precedence                  : 1
ReversibleEncryptionEnabled : False

Pierre Audonnet - MSFT 10,191 Reputation points Microsoft Employee

2020-10-20T12:48:04.21+00:00

On the relying party trust, I have only claim rule:

And this is the result in the Claims X Ray site:

techguy 6

Sure. Anonymized, but here we go.

PS C:\> Get-ADUserResultantPasswordPolicy -Identity testuser


AppliesTo                   : {CN=testuser,(...),DC=company,DC=xy}
ComplexityEnabled           : True
DistinguishedName           : CN=fgpp7days,CN=Password Settings Container,CN=System,DC=company,DC=xy
LockoutDuration             : 00:30:00
LockoutObservationWindow    : 00:30:00
LockoutThreshold            : 0
MaxPasswordAge              : 7.00:00:00
MinPasswordAge              : 1.00:00:00
MinPasswordLength           : 8
Name                        : fgpp7days
ObjectClass                 : msDS-PasswordSettings
ObjectGUID                  : 1234
PasswordHistoryCount        : 0
Precedence                  : 10
ReversibleEncryptionEnabled : False

techguy 6 Reputation points

2020-10-20T14:41:21.597+00:00

RP with claim rules
techguy 6 Reputation points

2020-10-20T14:41:51.93+00:00

Token response
Pierre Audonnet - MSFT 10,191 Reputation points Microsoft Employee

2020-10-20T14:46:10.797+00:00

Make sure the user doesn't have the check box "Password never expires". Also, can you share the raw token? (from the bottom of the Claims X Ray page)
techguy 6 Reputation points

2020-10-20T15:09:51+00:00

The option isn't activated. But in "net user testuser /domain" it shows, that the "password expires" is somewhere in 2021. But maybe does "net user" not check the FGPP...

RAW token see attached.33702-rawtoken.txt
Pierre Audonnet - MSFT 10,191 Reputation points Microsoft Employee

2020-10-20T15:15:54.22+00:00
Correct, the NET USER method doesn't account for the FGPP. But your command Get-ADUserResultantPasswordPolicy -Identity testuser is correct.

This is weird... Can you send all claims in the second rule:

c:[] =>issue( claim = c ) ;

And paste the screenshot of the results? Also make sure you check the checkbox "Force fresh authentication", to make sure, you can use the Forms option in the authentication policy section.
techguy 6 Reputation points

2020-10-20T15:24:32.81+00:00
Wow, the Forms option did the trick.

passwordexpirationdays 5 passwordexpirationtime 2020-10-26T09:16:56.320Z passwordexpirationtime 2020-10-26T09:16:56.320Z

I'll search for a colleague, who has to change his password in the next days and claim a xray token.
Pierre Audonnet - MSFT 10,191 Reputation points Microsoft Employee

2020-10-20T15:26:38.293+00:00

The issue was probably that you already had a valid token. So you were not re-processing the rules. When testing, the form ensure that you ask for a new token from scratch.
techguy 6 Reputation points

2020-10-20T15:43:36.313+00:00

Found a colleague with an expiring password in the next few days. Did the xray claim, here are the results.
Pierre Audonnet - MSFT 10,191 Reputation points Microsoft Employee

2020-10-20T16:41:17.293+00:00

At this stage we can confirm that the issue is not ADFS.

The doc actually says it will not work with Windows Integrated Authentication. So, the test to force Forms was key here (and not the token refresh).
Can you have the user use Forms in ADFS to authenticate to Outlook instead of the WIA as a test to see if you see the right number of days? I don't know if that's possible...

Share via

ADFS: Wrong number of days for password expiration

Your answer