John Dickinson
2008-Nov-06 14:03 UTC
[Fedora-directory-users] Re: WinSync userAccountControl bug (was Fedora-directory-users Digest, Vol 42, Issue 4)
Rich Megginson <rmeggins@redhat.com> wrote:> Howard Chu wrote: >>> Date: Tue, 04 Nov 2008 08:13:08 -0700 >>> From: Rich Megginson<rmeggins@redhat.com> >> >>> John Dickinson wrote: >>>> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins@redhat.com> >>>> wrote: >> >>>> create user in AD userAccountControl: 512 >>>> (Normal) >>>> create user in Fedora DS (console) userAccountControl: 546 >>>> (Normal + >>>> PASSWD_NOTREQ + ACCOUNTDISABLE) >>>> >>>> Would there be anything wrong with Fedora DS just forcing >>>> userAccountControl = 512? Or are more options needed in the user >>>> creation dialog? >>> I''m not sure. 1.1.3 included a "fix" for userAccountControl. The >>> way >>> it works now is this: >>> add new AD entry over LDAP - no userAccountControl attribute is >>> present, >>> so it must use some sort of AD default value >>> read the new AD entry - get the userAccountControl value >>> set AD entry userAccountControl |= 0x200 # 512 == normal account) >>> >>> So you might try a simple test - add a new AD entry over LDAP >>> outside of >>> windows sync - see what the default userAccountControl value is - >>> I''m >>> guessing that adding a new AD entry without specifying >>> userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE >> >> Yes, users created via LDAP are disabled unless you explicitly >> provide >> the userAccountControl attribute (with proper flags) in the LDAP Add >> operation. I tripped over this myself the first time I loaded up a >> test database in AD. (It also gave me a Fine Opportunity to time how >> long it took to LDAP Modify all of the users in my test database. >> ugh...) >> > Then this is a bug in the winsync code. In the ADD case, it should > just > force userAccountControl to the Normal value. In the MOD case, it > should |= the value. John, can you open a bug about this issue? > Thanks.Done - https://bugzilla.redhat.com/show_bug.cgi?id=470224 There are other values of userAccountControl that an administrator might want to set when creating users. One example is DONT_EXPIRE_PASSWORD - so is there a need for the userAccountControl flags to be configurable on a create user dialog such as that in fedora-idm-console or phpldapadmin rather than hard coded? John P.S. Sorry about the totally useless subject line earlier in this thread.
Rich Megginson
2008-Nov-06 14:30 UTC
Re: [Fedora-directory-users] Re: WinSync userAccountControl bug (was Fedora-directory-users Digest, Vol 42, Issue 4)
John Dickinson wrote:> Rich Megginson <rmeggins@redhat.com> wrote: > >> Howard Chu wrote: >>>> Date: Tue, 04 Nov 2008 08:13:08 -0700 >>>> From: Rich Megginson<rmeggins@redhat.com> >>> >>>> John Dickinson wrote: >>>>> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins@redhat.com> wrote: >>> >>>>> create user in AD userAccountControl: 512 (Normal) >>>>> create user in Fedora DS (console) userAccountControl: 546 >>>>> (Normal + >>>>> PASSWD_NOTREQ + ACCOUNTDISABLE) >>>>> >>>>> Would there be anything wrong with Fedora DS just forcing >>>>> userAccountControl = 512? Or are more options needed in the user >>>>> creation dialog? >>>> I''m not sure. 1.1.3 included a "fix" for userAccountControl. The way >>>> it works now is this: >>>> add new AD entry over LDAP - no userAccountControl attribute is >>>> present, >>>> so it must use some sort of AD default value >>>> read the new AD entry - get the userAccountControl value >>>> set AD entry userAccountControl |= 0x200 # 512 == normal account) >>>> >>>> So you might try a simple test - add a new AD entry over LDAP >>>> outside of >>>> windows sync - see what the default userAccountControl value is - I''m >>>> guessing that adding a new AD entry without specifying >>>> userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE >>> >>> Yes, users created via LDAP are disabled unless you explicitly provide >>> the userAccountControl attribute (with proper flags) in the LDAP Add >>> operation. I tripped over this myself the first time I loaded up a >>> test database in AD. (It also gave me a Fine Opportunity to time how >>> long it took to LDAP Modify all of the users in my test database. >>> ugh...) >>> >> Then this is a bug in the winsync code. In the ADD case, it should just >> force userAccountControl to the Normal value. In the MOD case, it >> should |= the value. John, can you open a bug about this issue? >> Thanks. > > Done - https://bugzilla.redhat.com/show_bug.cgi?id=470224Thanks.> > There are other values of userAccountControl that an administrator > might want to set when creating users. One example is > DONT_EXPIRE_PASSWORD - so is there a need for the userAccountControl > flags to be configurable on a create user dialog such as that in > fedora-idm-console or phpldapadmin rather than hard coded?Probably, but that''s for another bug/enhancement request.> > John > > P.S. Sorry about the totally useless subject line earlier in this thread. > > -- > Fedora-directory-users mailing list > Fedora-directory-users@redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users