* Steps to reproduce:
1. Newly created AD account with UserCanNotChangePassword=FALSE
Access RIghts:
Allow Everyone Change Password
Allow NT AUTHORITY\SELF Change Password
2. Change in AD to UserCanNotChangePassword=TRUE
Access RIghts:
Deny Everyone Change Password
Deny NT AUTHORITY\SELF Change Password
3. Change in AD to UserCanNotChangePassword=FALSE
-> Rights situation:
Allow Everyone Change Password
Steps 2 and 3 can be repeated at will in AD and always lead to the mentioned permissions.
Only newly created accounts have 2 Allow rights.
After the first change, only one Allow right for Everyone remains.
4.The account exists in OneIM with identical properties.
Change in OneIM to UserCanNotChangePassword=TRUE
-> Rights situation after provisioning:
Deny Everyone Change Password
Deny NT AUTHORITY\SELF Change Password
5. Change in OneIM to UserCanNotChangePassword=FALSE
-> Rights situation after provisioning:
NO right available. So it is not possible to change the pwd, although this should be possible -> false.
Steps 2 and 3 are NOT executed.
Step 4 leads in this case to:
Deny Everyone Change Password
Deny NT AUTHORITY\SELF Change Password
Allow Everyone Change Password
Allow NT AUTHORITY\SELF Change Password
Effectively the password change is not possible -> correct
Allow Everyone Change Password
Allow NT AUTHORITY\SELF Change Password
With this, the password change is possible again -> correct.
Conclusion:
Provisioning UserCanNotChangePassword only works correctly if the property has never been changed in AD before.
* Expected result:
Correct provisioning of UserCanNotChangePassword.