After upgrading to SPP 7.2 users are unable to log in with AD accounts (4371457)

After upgrading to SPP 7.2 users are unable to log in with AD accounts

Users are unable to log in with AD accounts to SPP, local accounts work properly
 

In the RSTS log the following error is found:

2023-05-13T20:21:40.635Z [Error] (Pangaea.Service.Rsts ) {RstsLogTraceListener.WriteInternal} Message: Object reference not set to an instance of an object.

Exception: System.NullReferenceException

Stack:

  at RSts.Sts.LdapCommon.Util.GetAttribute[T](SearchResultEntry sre, String name)

  at RSts.ActiveDirectoryProvider.Context.PopulateMaxPwdAndLockoutDurationCache(String path, Boolean isFgpp)

  at RSts.ActiveDirectoryProvider.Context.GetMaxPwdAge(String path, Boolean isFgpp)

  at RSts.ActiveDirectoryProvider.User.get_TimeUntilPasswordExpires()

  at Rsts.WebRoot.UserLogin.LoginController.PasswordExpirationCheck(IUser altUser) in D:\a\1\s\HttpService\WebRoot\UserLogin\LoginController.cs:line 1280

  at Rsts.WebRoot.UserLogin.LoginController.PrimaryLoginPost() in D:\a\1\s\HttpService\WebRoot\UserLogin\LoginController.cs:line 809

  at Rsts.WebRoot.UserLogin.LoginController.ProcessRequest(HttpListenerContext context) in D:\a\1\s\HttpService\WebRoot\UserLogin\LoginController.cs:line 218

SPP requires access to Fine-Grained Password Policies, if these are being used at the Domain level, the service account for the External Integration needs permission to read the password policy and the necessary rights to read for msDS-MaximumPasswordAge and msDS-LockoutDuration attributes.

If the permissions are set properly, (for example: the service account for External Integration is a member of the Domain Admins group) and the issue persists then the msDS-MaximumPasswordAge and msDS-LockoutDuration values are set to 'never'.
This triggers a Defect that has been identified as #413127 where SPP expects a numeric value and errors when the policies have 'never' as values for the LockoutDuration and MaxAgePwd fields.
 

RESOLUTION:
Permissions for Fine-Grained Password Policies:
1. Confirm the service account for External Integration has the rights to read Fine-Grained Password Policies for msDS-MaximumPasswordAge and msDS-LockoutDuration attributes.

Values for LockoutDuration and MaxAgePwd fields are set to "never":
1. This has been identified as Defect # 413127 and is targeted to be fixed in SPP 7.3

WORKAROUND:
Permissions for Fine-Grained Password Policies:
1. Add the service account for External Integration to the Domain Admins group

Values for LockoutDuration and MaxAgePwd fields are set to "never":
1. Change the value for LockoutDuration and MaxAgePwd at the Domain level from "never" to "9999:00:00:00" (Domain replication is required)

2. Perform a login to each SPP node with a domain account (should be successful after setting the value in the policy to be "9999:00:00:00")
3. Change the value for both attributes back to "never"

Note: All domain users should be able to log in, however, the issue will come back on a restart of the appliance, but the same workaround can be used again.

413127