UME attribute mapping for lastpasswordchange to AD

Question

We are on EP 7.0 and are using Microsoft Active Directory 2003 as our user repository.
I am using a writeable datasource configuration file to update passwords in AD from portal (SSL configured)
For users who had password reset done through the portal, portal has the information for "Date of Last Password Change".
However, for users who do password resets with other mechanisms (outside of SAP portal), portal does not have this information.
I am trying to map the UME logical attribute "lastpasswordchange" to the corresponding physical attribute on Active Directory - which I believe is "pwdLastSet".
My XML configuration looks like the following
<dataSource id="CORP_LDAP"
         <responsibleFor>
              <principal type="account">
                   <nameSpace name="com.sap.security.core.usermanagement">
                        <attribute name="j_user"/>
                        <attribute name="logonalias"/>
                        <attribute name="j_password"/>
                        <attribute name="userid"/>
                        <attribute name="lastpasswordchange"/>
                   </nameSpace>
                   <nameSpace name="com.sap.security.core.authentication">
                        <attribute name="principal"/>
                        <attribute name="realm"/>
                        <attribute name="domain"/>
                   </nameSpace>
              </principal>   
              <principal type="user">
              </principal>
              <principal type="group">
              </principal>
         </responsibleFor>
         <attributeMapping>
              <principal type="account">
                   <nameSpace name="com.sap.security.core.usermanagement">
                        <attribute name="j_user">
                             <physicalAttribute name="samaccountname"/>
                        </attribute>
                        <attribute name="logonalias">
                             <physicalAttribute name="samaccountname"/>
                        </attribute>
                        <attribute name="j_password">
                             <physicalAttribute name="unicodepwd"/>
                        </attribute>
                        <attribute name="userid">
                             <physicalAttribute name="*null*"/>
                        </attribute>
                        <attribute name="lastpasswordchange">
                             <physicalAttribute name="pwdLastSet"/>
                        </attribute>
                   </nameSpace>                  
                </principal>
              <principal type="user">
                   <nameSpace name="com.sap.security.core.usermanagement">
                        <attribute name="firstname">
                             <physicalAttribute name="givenname"/>
                        </attribute>
              </principal>
         </attributeMapping>
         <privateSection>              
         </privateSection>
    </dataSource>
However the above configuration doesn't work. I am not able to read the attribute "pwdLastSet" from AD using attribute mapping.
Can some one please suggest what I am missing ?
Thank You,

Answer 1

You may google "pwdLastSet convert" a try to find out some scripts to convert pwdLastSet to another timestamp.
As I got from some Google's [links|http://anothersysadmin.wordpress.com/2010/10/22/convert-pwdlastset-to-a-human-readable-date/] pwdLastSet it counts time in nanoseconds.
Consult you MS Active Diractory team for help to create the converting script of create another attribute in AD with the format that match the portal's timestamp. Then you'll map  the new AD attribute to the "lastpasswordchange" attribute of the portal.
Regards, Mikhail.