Howard Chu
2008-Nov-04 17:05 UTC
[Fedora-directory-users] Re: Fedora-directory-users Digest, Vol 42, Issue 4
> Date: Tue, 04 Nov 2008 08:13:08 -0700 > From: Rich Megginson<rmeggins@redhat.com>> John Dickinson wrote: >> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins@redhat.com> wrote:>> create user in AD userAccountControl: 512 (Normal) >> create user in Fedora DS (console) userAccountControl: 546 (Normal + >> PASSWD_NOTREQ + ACCOUNTDISABLE) >> >> Would there be anything wrong with Fedora DS just forcing >> userAccountControl = 512? Or are more options needed in the user >> creation dialog? > I''m not sure. 1.1.3 included a "fix" for userAccountControl. The way > it works now is this: > add new AD entry over LDAP - no userAccountControl attribute is present, > so it must use some sort of AD default value > read the new AD entry - get the userAccountControl value > set AD entry userAccountControl |= 0x200 # 512 == normal account) > > So you might try a simple test - add a new AD entry over LDAP outside of > windows sync - see what the default userAccountControl value is - I''m > guessing that adding a new AD entry without specifying > userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLEYes, users created via LDAP are disabled unless you explicitly provide the userAccountControl attribute (with proper flags) in the LDAP Add operation. I tripped over this myself the first time I loaded up a test database in AD. (It also gave me a Fine Opportunity to time how long it took to LDAP Modify all of the users in my test database. ugh...) -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/
Rich Megginson
2008-Nov-04 18:38 UTC
Re: [Fedora-directory-users] Re: Fedora-directory-users Digest, Vol 42, Issue 4
Howard Chu wrote:>> Date: Tue, 04 Nov 2008 08:13:08 -0700 >> From: Rich Megginson<rmeggins@redhat.com> > >> John Dickinson wrote: >>> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins@redhat.com> wrote: > >>> create user in AD userAccountControl: 512 (Normal) >>> create user in Fedora DS (console) userAccountControl: 546 (Normal + >>> PASSWD_NOTREQ + ACCOUNTDISABLE) >>> >>> Would there be anything wrong with Fedora DS just forcing >>> userAccountControl = 512? Or are more options needed in the user >>> creation dialog? >> I''m not sure. 1.1.3 included a "fix" for userAccountControl. The way >> it works now is this: >> add new AD entry over LDAP - no userAccountControl attribute is present, >> so it must use some sort of AD default value >> read the new AD entry - get the userAccountControl value >> set AD entry userAccountControl |= 0x200 # 512 == normal account) >> >> So you might try a simple test - add a new AD entry over LDAP outside of >> windows sync - see what the default userAccountControl value is - I''m >> guessing that adding a new AD entry without specifying >> userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE > > Yes, users created via LDAP are disabled unless you explicitly provide > the userAccountControl attribute (with proper flags) in the LDAP Add > operation. I tripped over this myself the first time I loaded up a > test database in AD. (It also gave me a Fine Opportunity to time how > long it took to LDAP Modify all of the users in my test database. ugh...) >Then this is a bug in the winsync code. In the ADD case, it should just force userAccountControl to the Normal value. In the MOD case, it should |= the value. John, can you open a bug about this issue? Thanks.
David Boreham
2008-Nov-04 18:52 UTC
Re: [Fedora-directory-users] Re: Fedora-directory-users Digest, Vol 42, Issue 4
Memory is hazy about this, but I seem to remember that it was done as two steps because AD didn''t allow userAccountControl to be set in the ADD. It had to be set by a separate MOD. Perhaps AD has changed since that time in this respect though. Rich Megginson wrote:> Howard Chu wrote: >>> Date: Tue, 04 Nov 2008 08:13:08 -0700 >>> From: Rich Megginson<rmeggins@redhat.com> >> >>> John Dickinson wrote: >>>> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins@redhat.com> wrote: >> >>>> create user in AD userAccountControl: 512 (Normal) >>>> create user in Fedora DS (console) userAccountControl: 546 (Normal + >>>> PASSWD_NOTREQ + ACCOUNTDISABLE) >>>> >>>> Would there be anything wrong with Fedora DS just forcing >>>> userAccountControl = 512? Or are more options needed in the user >>>> creation dialog? >>> I''m not sure. 1.1.3 included a "fix" for userAccountControl. The way >>> it works now is this: >>> add new AD entry over LDAP - no userAccountControl attribute is >>> present, >>> so it must use some sort of AD default value >>> read the new AD entry - get the userAccountControl value >>> set AD entry userAccountControl |= 0x200 # 512 == normal account) >>> >>> So you might try a simple test - add a new AD entry over LDAP >>> outside of >>> windows sync - see what the default userAccountControl value is - I''m >>> guessing that adding a new AD entry without specifying >>> userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE >> >> Yes, users created via LDAP are disabled unless you explicitly >> provide the userAccountControl attribute (with proper flags) in the >> LDAP Add operation. I tripped over this myself the first time I >> loaded up a test database in AD. (It also gave me a Fine Opportunity >> to time how long it took to LDAP Modify all of the users in my test >> database. ugh...) >> > Then this is a bug in the winsync code. In the ADD case, it should > just force userAccountControl to the Normal value. In the MOD case, > it should |= the value. John, can you open a bug about this issue? > Thanks. > > -- > Fedora-directory-users mailing list > Fedora-directory-users@redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users
Rich Megginson
2008-Nov-04 19:27 UTC
Re: [Fedora-directory-users] Re: Fedora-directory-users Digest, Vol 42, Issue 4
David Boreham wrote:> > Memory is hazy about this, but I seem to remember that it was done as > two steps because AD didn''t allow userAccountControl to be set in the > ADD. It had to be set by a separate MOD. Perhaps AD has changed since > that time in this respect though.No, I broke this in 1.1.3 - it was working fine in 1.1.2.> > Rich Megginson wrote: >> Howard Chu wrote: >>>> Date: Tue, 04 Nov 2008 08:13:08 -0700 >>>> From: Rich Megginson<rmeggins@redhat.com> >>> >>>> John Dickinson wrote: >>>>> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins@redhat.com> wrote: >>> >>>>> create user in AD userAccountControl: 512 (Normal) >>>>> create user in Fedora DS (console) userAccountControl: 546 >>>>> (Normal + >>>>> PASSWD_NOTREQ + ACCOUNTDISABLE) >>>>> >>>>> Would there be anything wrong with Fedora DS just forcing >>>>> userAccountControl = 512? Or are more options needed in the user >>>>> creation dialog? >>>> I''m not sure. 1.1.3 included a "fix" for userAccountControl. The way >>>> it works now is this: >>>> add new AD entry over LDAP - no userAccountControl attribute is >>>> present, >>>> so it must use some sort of AD default value >>>> read the new AD entry - get the userAccountControl value >>>> set AD entry userAccountControl |= 0x200 # 512 == normal account) >>>> >>>> So you might try a simple test - add a new AD entry over LDAP >>>> outside of >>>> windows sync - see what the default userAccountControl value is - I''m >>>> guessing that adding a new AD entry without specifying >>>> userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE >>> >>> Yes, users created via LDAP are disabled unless you explicitly >>> provide the userAccountControl attribute (with proper flags) in the >>> LDAP Add operation. I tripped over this myself the first time I >>> loaded up a test database in AD. (It also gave me a Fine Opportunity >>> to time how long it took to LDAP Modify all of the users in my test >>> database. ugh...) >>> >> Then this is a bug in the winsync code. In the ADD case, it should >> just force userAccountControl to the Normal value. In the MOD case, >> it should |= the value. John, can you open a bug about this issue? >> Thanks. >> >> -- >> Fedora-directory-users mailing list >> Fedora-directory-users@redhat.com >> https://www.redhat.com/mailman/listinfo/fedora-directory-users > > -- > Fedora-directory-users mailing list > Fedora-directory-users@redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users