User list fails on protected AD account krbtgt_AzureAD

[DavidePrincipi]

When NS8 tries to list users from a remote Active Directory, it crashes if one of the accounts has missing information for fields like "account locked." This happens with special hidden accounts that Windows protects, such as the krbtgt_AzureAD account used for Azure AD Kerberos. NS8 expects those fields to always have a value, so when one is missing it stops with an error instead of simply skipping it.

To Reproduce

1. Connect NS8 to a remote AD domain that has Azure AD Kerberos / Azure AD Connect set up (this creates a protected account named something like krbtgt_AzureAD).
2. Run: api-cli run list-domain-users --data '{"domain":"<your-domain>"}'
3. The command fails with an error like:

   TypeError: unsupported operand type(s) for &: 'list' and 'int'
   

Expected behavior
The user list should load normally. If some information can't be read for a particular account (because Windows restricts access to it), NS8 should just treat it as "unknown" and continue, instead of crashing the whole list.

Components
NS8 core 3.21.1

Additional context

• The account that triggers this is a special system account, not a normal user — Windows hides some of its details from regular accounts for security reasons.
• Full error and LDAP data available on request.

See also

• Discussion https://mattermost.nethesis.it/nethesis/pl/xj7gran5atfnipu9guuib5yzeh

---

Thanks to @lucagasparini

[DavidePrincipi]

In Testing 3.22.0-dev.5

Test case 1 - regression check

In an existing installation, save the output of list-domain-users

 api-cli run list-domain-users | jq > list-domain-users.stable.json

Update to Testing version and save the action output to a different file:

 api-cli run list-domain-users | jq > list-domain-users.testing.json

Check there are no changes in the way "Must change" flag anb "Expired" flag are returned by list-domain-users. Also the password expiration date must be unchanged for positive values. See bug 8153 for changes to negative values.

Test case 2 - bug not reproducible

Check the bug is not reproducible with Testing version.