Fedora directory users - Nov 2008 - Re: Fedora-directory-users Digest, Vol 42, Issue 4

> Date: Tue, 04 Nov 2008 08:13:08 -0700
> From: Rich Megginson<rmeggins@redhat.com>
> John Dickinson wrote:
>> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins@redhat.com> 
wrote:
>> create user in AD                    userAccountControl: 512 (Normal)
>> create user in Fedora DS (console)   userAccountControl: 546 (Normal +
>> PASSWD_NOTREQ + ACCOUNTDISABLE)
>>
>> Would there be anything wrong with Fedora DS just forcing
>> userAccountControl = 512? Or are more options needed in the user
>> creation dialog?
> I''m not sure.  1.1.3 included a "fix" for
userAccountControl.  The way
> it works now is this:
> add new AD entry over LDAP - no userAccountControl attribute is present,
> so it must use some sort of AD default value
> read the new AD entry - get the userAccountControl value
> set AD entry userAccountControl |= 0x200 # 512 == normal account)
>
> So you might try a simple test - add a new AD entry over LDAP outside of
> windows sync - see what the default userAccountControl value is -
I''m
> guessing that adding a new AD entry without specifying
> userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE
Yes, users created via LDAP are disabled unless you explicitly provide the 
userAccountControl attribute (with proper flags) in the LDAP Add operation. I 
tripped over this myself the first time I loaded up a test database in AD. (It 
also gave me a Fine Opportunity to time how long it took to LDAP Modify all of 
the users in my test database. ugh...)

-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/

Howard Chu wrote:
>> Date: Tue, 04 Nov 2008 08:13:08 -0700
>> From: Rich Megginson<rmeggins@redhat.com>
>
>> John Dickinson wrote:
>>> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins@redhat.com>
wrote:
>
>>> create user in AD                    userAccountControl: 512
(Normal)
>>> create user in Fedora DS (console)   userAccountControl: 546
(Normal +
>>> PASSWD_NOTREQ + ACCOUNTDISABLE)
>>>
>>> Would there be anything wrong with Fedora DS just forcing
>>> userAccountControl = 512? Or are more options needed in the user
>>> creation dialog?
>> I''m not sure.  1.1.3 included a "fix" for
userAccountControl.  The way
>> it works now is this:
>> add new AD entry over LDAP - no userAccountControl attribute is
present,
>> so it must use some sort of AD default value
>> read the new AD entry - get the userAccountControl value
>> set AD entry userAccountControl |= 0x200 # 512 == normal account)
>>
>> So you might try a simple test - add a new AD entry over LDAP outside
of
>> windows sync - see what the default userAccountControl value is -
I''m
>> guessing that adding a new AD entry without specifying
>> userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE
>
> Yes, users created via LDAP are disabled unless you explicitly provide 
> the userAccountControl attribute (with proper flags) in the LDAP Add 
> operation. I tripped over this myself the first time I loaded up a 
> test database in AD. (It also gave me a Fine Opportunity to time how 
> long it took to LDAP Modify all of the users in my test database. ugh...)
>
Then this is a bug in the winsync code.  In the ADD case, it should just 
force userAccountControl to the Normal value.  In the MOD case, it 
should |= the value.  John, can you open a bug about this issue?  Thanks.

Memory is hazy about this, but I seem to remember that it was done as 
two steps because AD didn''t allow userAccountControl to be set in the 
ADD. It had to be set by a separate MOD. Perhaps AD has changed since 
that time in this respect though.

Rich Megginson wrote:
> Howard Chu wrote:
>>> Date: Tue, 04 Nov 2008 08:13:08 -0700
>>> From: Rich Megginson<rmeggins@redhat.com>
>>
>>> John Dickinson wrote:
>>>> On 30 Oct 2008, at 16:00, Rich
Megginson<rmeggins@redhat.com>  wrote:
>>
>>>> create user in AD                    userAccountControl: 512
(Normal)
>>>> create user in Fedora DS (console)   userAccountControl: 546
(Normal +
>>>> PASSWD_NOTREQ + ACCOUNTDISABLE)
>>>>
>>>> Would there be anything wrong with Fedora DS just forcing
>>>> userAccountControl = 512? Or are more options needed in the
user
>>>> creation dialog?
>>> I''m not sure.  1.1.3 included a "fix" for
userAccountControl.  The way
>>> it works now is this:
>>> add new AD entry over LDAP - no userAccountControl attribute is 
>>> present,
>>> so it must use some sort of AD default value
>>> read the new AD entry - get the userAccountControl value
>>> set AD entry userAccountControl |= 0x200 # 512 == normal account)
>>>
>>> So you might try a simple test - add a new AD entry over LDAP 
>>> outside of
>>> windows sync - see what the default userAccountControl value is -
I''m
>>> guessing that adding a new AD entry without specifying
>>> userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE
>>
>> Yes, users created via LDAP are disabled unless you explicitly 
>> provide the userAccountControl attribute (with proper flags) in the 
>> LDAP Add operation. I tripped over this myself the first time I 
>> loaded up a test database in AD. (It also gave me a Fine Opportunity 
>> to time how long it took to LDAP Modify all of the users in my test 
>> database. ugh...)
>>
> Then this is a bug in the winsync code.  In the ADD case, it should 
> just force userAccountControl to the Normal value.  In the MOD case, 
> it should |= the value.  John, can you open a bug about this issue?  
> Thanks.
>
> -- 
> Fedora-directory-users mailing list
> Fedora-directory-users@redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users

David Boreham wrote:
>
> Memory is hazy about this, but I seem to remember that it was done as 
> two steps because AD didn''t allow userAccountControl to be set in
the
> ADD. It had to be set by a separate MOD. Perhaps AD has changed since 
> that time in this respect though.
No, I broke this in 1.1.3 - it was working fine in
1.1.2.
>
> Rich Megginson wrote:
>> Howard Chu wrote:
>>>> Date: Tue, 04 Nov 2008 08:13:08 -0700
>>>> From: Rich Megginson<rmeggins@redhat.com>
>>>
>>>> John Dickinson wrote:
>>>>> On 30 Oct 2008, at 16:00, Rich
Megginson<rmeggins@redhat.com>  wrote:
>>>
>>>>> create user in AD                    userAccountControl:
512 (Normal)
>>>>> create user in Fedora DS (console)   userAccountControl:
546
>>>>> (Normal +
>>>>> PASSWD_NOTREQ + ACCOUNTDISABLE)
>>>>>
>>>>> Would there be anything wrong with Fedora DS just forcing
>>>>> userAccountControl = 512? Or are more options needed in the
user
>>>>> creation dialog?
>>>> I''m not sure.  1.1.3 included a "fix" for
userAccountControl.  The way
>>>> it works now is this:
>>>> add new AD entry over LDAP - no userAccountControl attribute is
>>>> present,
>>>> so it must use some sort of AD default value
>>>> read the new AD entry - get the userAccountControl value
>>>> set AD entry userAccountControl |= 0x200 # 512 == normal
account)
>>>>
>>>> So you might try a simple test - add a new AD entry over LDAP 
>>>> outside of
>>>> windows sync - see what the default userAccountControl value is
- I''m
>>>> guessing that adding a new AD entry without specifying
>>>> userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE
>>>
>>> Yes, users created via LDAP are disabled unless you explicitly 
>>> provide the userAccountControl attribute (with proper flags) in the
>>> LDAP Add operation. I tripped over this myself the first time I 
>>> loaded up a test database in AD. (It also gave me a Fine
Opportunity
>>> to time how long it took to LDAP Modify all of the users in my test
>>> database. ugh...)
>>>
>> Then this is a bug in the winsync code.  In the ADD case, it should 
>> just force userAccountControl to the Normal value.  In the MOD case, 
>> it should |= the value.  John, can you open a bug about this issue?  
>> Thanks.
>>
>> -- 
>> Fedora-directory-users mailing list
>> Fedora-directory-users@redhat.com
>> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
> -- 
> Fedora-directory-users mailing list
> Fedora-directory-users@redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users