--- policy: /ce/ca/oracle/iam/domain-password-policy-expiration logic: /ce/ca/oracle/iam/domain-password-policy-expiration/prod.logic.yaml executionTime: 2026-11-14T12:04:31.878128825Z generationMs: 45 executionMs: 641 rows: - id: domain-password-policy-expiration-0 match: true status: expected: UNDETERMINED actual: UNDETERMINED conditionIndex: expected: 199 actual: 199 conditionText: expected: extract('CA10O1__passwordExpiresAfterDays__c').isEmpty() actual: extract('CA10O1__passwordExpiresAfterDays__c').isEmpty() runtimeError: {} - id: domain-password-policy-expiration-1 match: true status: expected: INCOMPLIANT actual: INCOMPLIANT conditionIndex: expected: 299 actual: 299 conditionText: expected: extract('CA10O1__passwordExpiresAfterDays__c') <= number(0.0) || extract('CA10O1__passwordExpiresAfterDays__c') > number(365.0) actual: extract('CA10O1__passwordExpiresAfterDays__c') <= number(0.0) || extract('CA10O1__passwordExpiresAfterDays__c') > number(365.0) runtimeError: {} - id: domain-password-policy-expiration-2 match: true status: expected: INCOMPLIANT actual: INCOMPLIANT conditionIndex: expected: 299 actual: 299 conditionText: expected: extract('CA10O1__passwordExpiresAfterDays__c') <= number(0.0) || extract('CA10O1__passwordExpiresAfterDays__c') > number(365.0) actual: extract('CA10O1__passwordExpiresAfterDays__c') <= number(0.0) || extract('CA10O1__passwordExpiresAfterDays__c') > number(365.0) runtimeError: {} - id: domain-password-policy-expiration-3 match: true status: expected: COMPLIANT actual: COMPLIANT conditionIndex: expected: 300 actual: 300 conditionText: expected: otherwise actual: otherwise runtimeError: {} - id: domain-password-policy-expiration-4 match: true status: expected: COMPLIANT actual: COMPLIANT conditionIndex: expected: 300 actual: 300 conditionText: expected: otherwise actual: otherwise runtimeError: {} - id: domain-password-policy-expiration-5 match: true status: expected: COMPLIANT actual: COMPLIANT conditionIndex: expected: 300 actual: 300 conditionText: expected: otherwise actual: otherwise runtimeError: {} - id: domain-password-policy-expiration-6 match: true status: expected: INCOMPLIANT actual: INCOMPLIANT conditionIndex: expected: 299 actual: 299 conditionText: expected: extract('CA10O1__passwordExpiresAfterDays__c') <= number(0.0) || extract('CA10O1__passwordExpiresAfterDays__c') > number(365.0) actual: extract('CA10O1__passwordExpiresAfterDays__c') <= number(0.0) || extract('CA10O1__passwordExpiresAfterDays__c') > number(365.0) runtimeError: {} - id: domain-password-policy-expiration-deleted match: true status: expected: DISAPPEARED actual: DISAPPEARED conditionIndex: expected: 99 actual: 99 conditionText: expected: isDisappeared(CA10O1__disappearanceTime__c) actual: isDisappeared(CA10O1__disappearanceTime__c) runtimeError: {} usedFiles: - path: /ce/ca/oracle/iam/domain-password-policy-expiration/policy.yaml md5Hash: 3D5DA5BDE365AD62E3DD721D35AD8FE5 content: | --- names: full: Oracle IAM Domain Password Policy does not expire passwords within 365 days contextual: Domain Password Policy does not expire passwords within 365 days description: Set Expires after (days) to a value from 1 to 365. type: COMPLIANCE_POLICY categories: - SECURITY frameworkMappings: - /frameworks/cis-oracle-v3.1.1/01/05 - /frameworks/cloudaware/identity-and-access-governance/credential-lifecycle-management - path: /ce/ca/oracle/iam/domain-password-policy-expiration/prod.logic.yaml md5Hash: B40455645AF54FB0CE902204D110C236 content: | --- inputType: CA10O1__CaOracleIamDomainPasswordPolicy__c testData: - file: test-data.json importExtracts: - file: /types/CA10O1__CaOracleIamDomainPasswordPolicy__c/object.extracts.yaml conditions: - status: UNDETERMINED currentStateMessage: The password policy expiration setting is not available. check: IS_EMPTY: arg: EXTRACT: CA10O1__passwordExpiresAfterDays__c - status: INCOMPLIANT currentStateMessage: The password policy does not expire passwords within 365 days. remediationMessage: Set Expires after (days) to a value from 1 to 365. check: OR: args: - LESS_THAN_EQUAL: left: EXTRACT: CA10O1__passwordExpiresAfterDays__c right: NUMBER: 0 - GREATER_THAN: left: EXTRACT: CA10O1__passwordExpiresAfterDays__c right: NUMBER: 365 otherwise: status: COMPLIANT currentStateMessage: The password policy expires passwords within 365 days. - path: /ce/ca/oracle/iam/domain-password-policy-expiration/test-data.json md5Hash: 76C5F75026D21686D9F4BF14F0F52C21 content: | [ { "Id": "domain-password-policy-expiration-0", "CA10O1__name__c": "customPolicy", "CA10O1__passwordExpiresAfterDays__c": null, "expectedResult": { "status": "UNDETERMINED", "runtimeError": null, "conditionIndex": 199, "conditionText": "extract('CA10O1__passwordExpiresAfterDays__c').isEmpty()" }, "CA10O1__disappearanceTime__c": null }, { "Id": "domain-password-policy-expiration-1", "CA10O1__name__c": "defaultPasswordPolicy", "CA10O1__passwordExpiresAfterDays__c": -1, "expectedResult": { "status": "INCOMPLIANT", "runtimeError": null, "conditionIndex": 299, "conditionText": "extract('CA10O1__passwordExpiresAfterDays__c') <= number(0.0) || extract('CA10O1__passwordExpiresAfterDays__c') > number(365.0)" }, "CA10O1__disappearanceTime__c": null }, { "Id": "domain-password-policy-expiration-2", "CA10O1__name__c": "customPolicy", "CA10O1__passwordExpiresAfterDays__c": 0, "expectedResult": { "status": "INCOMPLIANT", "runtimeError": null, "conditionIndex": 299, "conditionText": "extract('CA10O1__passwordExpiresAfterDays__c') <= number(0.0) || extract('CA10O1__passwordExpiresAfterDays__c') > number(365.0)" }, "CA10O1__disappearanceTime__c": null }, { "Id": "domain-password-policy-expiration-3", "CA10O1__name__c": "defaultPasswordPolicy", "CA10O1__passwordExpiresAfterDays__c": 1, "expectedResult": { "status": "COMPLIANT", "runtimeError": null, "conditionIndex": 300, "conditionText": "otherwise" }, "CA10O1__disappearanceTime__c": null }, { "Id": "domain-password-policy-expiration-4", "CA10O1__name__c": "customPolicy", "CA10O1__passwordExpiresAfterDays__c": 364, "expectedResult": { "status": "COMPLIANT", "runtimeError": null, "conditionIndex": 300, "conditionText": "otherwise" }, "CA10O1__disappearanceTime__c": null }, { "Id": "domain-password-policy-expiration-5", "CA10O1__name__c": "defaultPasswordPolicy", "CA10O1__passwordExpiresAfterDays__c": 365, "expectedResult": { "status": "COMPLIANT", "runtimeError": null, "conditionIndex": 300, "conditionText": "otherwise" }, "CA10O1__disappearanceTime__c": null }, { "Id": "domain-password-policy-expiration-6", "CA10O1__name__c": "customPolicy", "CA10O1__passwordExpiresAfterDays__c": 366, "expectedResult": { "status": "INCOMPLIANT", "runtimeError": null, "conditionIndex": 299, "conditionText": "extract('CA10O1__passwordExpiresAfterDays__c') <= number(0.0) || extract('CA10O1__passwordExpiresAfterDays__c') > number(365.0)" }, "CA10O1__disappearanceTime__c": null }, { "Id": "domain-password-policy-expiration-deleted", "CA10O1__name__c": "customPolicy", "CA10O1__passwordExpiresAfterDays__c": 366, "expectedResult": { "status": "DISAPPEARED", "runtimeError": null, "conditionIndex": 99, "conditionText": "isDisappeared(CA10O1__disappearanceTime__c)" }, "CA10O1__disappearanceTime__c": "2026-01-01T00:00:00Z" } ] - path: /types/CA10O1__CaOracleIamDomainPasswordPolicy__c/object.extracts.yaml md5Hash: 27E2F3F632C452CC4BAD92DD21680769 content: | --- extracts: - name: "CA10O1__name__c" value: FIELD: path: "CA10O1__name__c" # Nullable - name: "CA10O1__passwordLengthMinimum__c" value: FIELD: path: "CA10O1__passwordLengthMinimum__c" # Nullable - name: "CA10O1__minNumerals__c" value: FIELD: path: "CA10O1__minNumerals__c" # Nullable - name: "CA10O1__minSpecialCharacters__c" value: FIELD: path: "CA10O1__minSpecialCharacters__c" - name: "CA10O1__passwordExpiresAfterDays__c" value: FIELD: path: "CA10O1__passwordExpiresAfterDays__c" - name: "CA10O1__previousPasswordsRemembered__c" value: FIELD: path: "CA10O1__previousPasswordsRemembered__c" script: |- CREATE TEMP FUNCTION mock_ExpectedResult() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "Id" : "domain-password-policy-expiration-0", "expectedResult" : { "status" : "UNDETERMINED", "runtimeError" : null, "conditionIndex" : 199, "conditionText" : "extract('CA10O1__passwordExpiresAfterDays__c').isEmpty()" } }, { "Id" : "domain-password-policy-expiration-1", "expectedResult" : { "status" : "INCOMPLIANT", "runtimeError" : null, "conditionIndex" : 299, "conditionText" : "extract('CA10O1__passwordExpiresAfterDays__c') <= number(0.0) || extract('CA10O1__passwordExpiresAfterDays__c') > number(365.0)" } }, { "Id" : "domain-password-policy-expiration-2", "expectedResult" : { "status" : "INCOMPLIANT", "runtimeError" : null, "conditionIndex" : 299, "conditionText" : "extract('CA10O1__passwordExpiresAfterDays__c') <= number(0.0) || extract('CA10O1__passwordExpiresAfterDays__c') > number(365.0)" } }, { "Id" : "domain-password-policy-expiration-3", "expectedResult" : { "status" : "COMPLIANT", "runtimeError" : null, "conditionIndex" : 300, "conditionText" : "otherwise" } }, { "Id" : "domain-password-policy-expiration-4", "expectedResult" : { "status" : "COMPLIANT", "runtimeError" : null, "conditionIndex" : 300, "conditionText" : "otherwise" } }, { "Id" : "domain-password-policy-expiration-5", "expectedResult" : { "status" : "COMPLIANT", "runtimeError" : null, "conditionIndex" : 300, "conditionText" : "otherwise" } }, { "Id" : "domain-password-policy-expiration-6", "expectedResult" : { "status" : "INCOMPLIANT", "runtimeError" : null, "conditionIndex" : 299, "conditionText" : "extract('CA10O1__passwordExpiresAfterDays__c') <= number(0.0) || extract('CA10O1__passwordExpiresAfterDays__c') > number(365.0)" } }, { "Id" : "domain-password-policy-expiration-deleted", "expectedResult" : { "status" : "DISAPPEARED", "runtimeError" : null, "conditionIndex" : 99, "conditionText" : "isDisappeared(CA10O1__disappearanceTime__c)" } } ]; """; CREATE TEMP FUNCTION mock_CA10O1__CaOracleIamDomainPasswordPolicy__c() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "CA10O1__passwordExpiresAfterDays__c" : null, "Id" : "domain-password-policy-expiration-0" }, { "CA10O1__passwordExpiresAfterDays__c" : -1, "Id" : "domain-password-policy-expiration-1" }, { "CA10O1__passwordExpiresAfterDays__c" : 0, "Id" : "domain-password-policy-expiration-2" }, { "CA10O1__passwordExpiresAfterDays__c" : 1, "Id" : "domain-password-policy-expiration-3" }, { "CA10O1__passwordExpiresAfterDays__c" : 364, "Id" : "domain-password-policy-expiration-4" }, { "CA10O1__passwordExpiresAfterDays__c" : 365, "Id" : "domain-password-policy-expiration-5" }, { "CA10O1__passwordExpiresAfterDays__c" : 366, "Id" : "domain-password-policy-expiration-6" }, { "CA10O1__disappearanceTime__c" : new Date("2026-01-01T00:00:00Z"), "CA10O1__passwordExpiresAfterDays__c" : 366, "Id" : "domain-password-policy-expiration-deleted" } ]; """; CREATE TEMP FUNCTION process_CA10O1__CaOracleIamDomainPasswordPolicy__c( obj STRUCT< CA10O1__disappearanceTime__c TIMESTAMP, CA10O1__passwordExpiresAfterDays__c FLOAT64, Id STRING >, snapshotTime TIMESTAMP ) RETURNS STRUCT DETERMINISTIC LANGUAGE js AS r""" var IsEmptyLib = new function () { this.simpleIsEmpty = function(arg) { return arg == null; }; this.simpleIsNotEmpty = function(arg) { return arg != null; }; }(); var references1 = []; // condition[0], conditionIndex:[0..99] references1.push('Deleted From Oracle [CA10O1__disappearanceTime__c]: ' + obj.CA10O1__disappearanceTime__c); if (obj.CA10O1__disappearanceTime__c != null) { return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10O1__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[1], conditionIndex:[100..199] function extract3() { if (!this.out) { this.out = obj.CA10O1__passwordExpiresAfterDays__c; } return this.out; }; references1.push('Password Expires After (days) [obj.CA10O1__passwordExpiresAfterDays__c]: ' + obj.CA10O1__passwordExpiresAfterDays__c); if (IsEmptyLib.simpleIsEmpty(extract3.call(extract3))) { return {status: 'UNDETERMINED', conditionIndex: 199, conditionText: "extract('CA10O1__passwordExpiresAfterDays__c').isEmpty()", currentStateMessage: "The password policy expiration setting is not available.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[2], conditionIndex:[200..299] function extract7() { if (!this.out) { this.out = obj.CA10O1__passwordExpiresAfterDays__c; } return this.out; }; if ((extract7.call(extract7) != null && 0.0 != null && extract7.call(extract7) <= 0.0) || (extract7.call(extract7) != null && 365.0 != null && extract7.call(extract7) > 365.0)) { return {status: 'INCOMPLIANT', conditionIndex: 299, conditionText: "extract('CA10O1__passwordExpiresAfterDays__c') <= number(0.0) || extract('CA10O1__passwordExpiresAfterDays__c') > number(365.0)", currentStateMessage: "The password policy does not expire passwords within 365 days.", currentStateReferences: references1.join('\n'), remediation: "Set Expires after (days) to a value from 1 to 365.", runtimeError: null}; } return {status: 'COMPLIANT', conditionIndex: 300, conditionText: "otherwise", currentStateMessage: "The password policy expires passwords within 365 days.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; """; SELECT expectedResult.Id as Id, IF ( IFNULL(expectedResult.expectedResult.status, '') = IFNULL(sObject.result.status, '') AND IFNULL(expectedResult.expectedResult.conditionIndex, -1) = IFNULL(sObject.result.conditionIndex, -1) AND IFNULL(expectedResult.expectedResult.conditionText, '') = IFNULL(sObject.result.conditionText, '') AND IFNULL(expectedResult.expectedResult.runtimeError, '') = IFNULL(sObject.result.runtimeError, ''), "MATCH", "FAIL" ) as match, expectedResult.expectedResult.status as expectedStatus, sObject.result.status as actualStatus, expectedResult.expectedResult.conditionIndex as expectedConditionIndex, sObject.result.conditionIndex as actualConditionIndex, expectedResult.expectedResult.conditionText as expectedConditionText, sObject.result.conditionText as actualConditionText, expectedResult.expectedResult.runtimeError as expectedRuntimeError, sObject.result.runtimeError as actualRuntimeError FROM UNNEST(mock_ExpectedResult()) expectedResult LEFT JOIN ( SELECT sObject.CA10O1__disappearanceTime__c AS CA10O1__disappearanceTime__c, sObject.CA10O1__passwordExpiresAfterDays__c AS CA10O1__passwordExpiresAfterDays__c, sObject.Id AS Id, process_CA10O1__CaOracleIamDomainPasswordPolicy__c( STRUCT( sObject.CA10O1__disappearanceTime__c AS CA10O1__disappearanceTime__c, sObject.CA10O1__passwordExpiresAfterDays__c AS CA10O1__passwordExpiresAfterDays__c, sObject.Id AS Id ), sObject.context.snapshotTime ) as result FROM UNNEST(mock_CA10O1__CaOracleIamDomainPasswordPolicy__c()) AS sObject ) sObject ON sObject.Id = expectedResult.Id;