[Fedora-directory-users] Re: Fedora-directory-users Digest, Vol 42, Issue 4

[Howard Chu]

> Date: Tue, 04 Nov 2008 08:13:08 -0700
> From: Rich Megginson<rmeggins at redhat.com>

> John Dickinson wrote:
>> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins at redhat.com>  wrote:

>> create user in AD                    userAccountControl: 512 (Normal)
>> create user in Fedora DS (console)   userAccountControl: 546 (Normal +
>> PASSWD_NOTREQ + ACCOUNTDISABLE)
>>
>> Would there be anything wrong with Fedora DS just forcing
>> userAccountControl = 512? Or are more options needed in the user
>> creation dialog?
> I'm not sure.  1.1.3 included a "fix" for userAccountControl.  The way
> it works now is this:
> add new AD entry over LDAP - no userAccountControl attribute is present,
> so it must use some sort of AD default value
> read the new AD entry - get the userAccountControl value
> set AD entry userAccountControl |= 0x200 # 512 == normal account)
>
> So you might try a simple test - add a new AD entry over LDAP outside of
> windows sync - see what the default userAccountControl value is - I'm
> guessing that adding a new AD entry without specifying
> userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE

Yes, users created via LDAP are disabled unless you explicitly provide the 
userAccountControl attribute (with proper flags) in the LDAP Add operation. I 
tripped over this myself the first time I loaded up a test database in AD. (It 
also gave me a Fine Opportunity to time how long it took to LDAP Modify all of 
the users in my test database. ugh...)

-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/