[Fedora-directory-users] Re: WinSync userAccountControl bug (was Fedora-directory-users Digest, Vol 42, Issue 4)
Rich Megginson
rmeggins at redhat.com
Thu Nov 6 14:30:51 UTC 2008
John Dickinson wrote:
> Rich Megginson <rmeggins at redhat.com> wrote:
>
>> Howard Chu wrote:
>>>> Date: Tue, 04 Nov 2008 08:13:08 -0700
>>>> From: Rich Megginson<rmeggins at redhat.com>
>>>
>>>> John Dickinson wrote:
>>>>> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins at redhat.com> wrote:
>>>
>>>>> create user in AD userAccountControl: 512 (Normal)
>>>>> create user in Fedora DS (console) userAccountControl: 546
>>>>> (Normal +
>>>>> PASSWD_NOTREQ + ACCOUNTDISABLE)
>>>>>
>>>>> Would there be anything wrong with Fedora DS just forcing
>>>>> userAccountControl = 512? Or are more options needed in the user
>>>>> creation dialog?
>>>> I'm not sure. 1.1.3 included a "fix" for userAccountControl. The way
>>>> it works now is this:
>>>> add new AD entry over LDAP - no userAccountControl attribute is
>>>> present,
>>>> so it must use some sort of AD default value
>>>> read the new AD entry - get the userAccountControl value
>>>> set AD entry userAccountControl |= 0x200 # 512 == normal account)
>>>>
>>>> So you might try a simple test - add a new AD entry over LDAP
>>>> outside of
>>>> windows sync - see what the default userAccountControl value is - I'm
>>>> guessing that adding a new AD entry without specifying
>>>> userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE
>>>
>>> Yes, users created via LDAP are disabled unless you explicitly provide
>>> the userAccountControl attribute (with proper flags) in the LDAP Add
>>> operation. I tripped over this myself the first time I loaded up a
>>> test database in AD. (It also gave me a Fine Opportunity to time how
>>> long it took to LDAP Modify all of the users in my test database.
>>> ugh...)
>>>
>> Then this is a bug in the winsync code. In the ADD case, it should just
>> force userAccountControl to the Normal value. In the MOD case, it
>> should |= the value. John, can you open a bug about this issue?
>> Thanks.
>
> Done - https://bugzilla.redhat.com/show_bug.cgi?id=470224
Thanks.
>
> There are other values of userAccountControl that an administrator
> might want to set when creating users. One example is
> DONT_EXPIRE_PASSWORD - so is there a need for the userAccountControl
> flags to be configurable on a create user dialog such as that in
> fedora-idm-console or phpldapadmin rather than hard coded?
Probably, but that's for another bug/enhancement request.
>
> John
>
> P.S. Sorry about the totally useless subject line earlier in this thread.
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
More information about the Fedora-directory-users
mailing list