[389-commits] Branch '389-ds-base-1.3.3' - ldap/servers

[Noriko Hosoi]

 ldap/servers/plugins/posix-winsync/posix-winsync.c |    3 +++
 1 file changed, 3 insertions(+)

New commits:
commit 33a5ade48caba8673748a4f7aee072596a8f6d53
Author: Noriko Hosoi <nhosoi at redhat.com>
Date:   Mon Jan 26 16:08:40 2015 -0800

    Ticket #48001 - ns-activate.pl fails to activate account if it was disabled on AD
    
    Bug Description: When Posix-WinSync plug-in receives a request to
    disable an account from AD, it checks the nsAccountLock explicitly
    as well as virtually.  If it's not found in the both checks, it does
    not set a flag to tell it is a virtual attribute, then a real
    "nsAccountLock: true" attr-value pair is added to the user entry.
    Once the real nsAccountLock attribute is added to an entry, ns-activate.pl
    as well as Console does not remove it since it's not implemented for
    the purpose.
    
    Fix Description: Since nsAccountLock is known as a virtual attribute,
    set a virtual flag by default, which prevents to add a real attribute
    value pair.
    
    https://fedorahosted.org/389/ticket/48001
    
    Reviewed by mreynolds at redhat.com (Thank you, Mark!!)
    
    (cherry picked from commit 345d2c0870d7e8b1005a13cc9cf93865ff0cb53d)

diff --git a/ldap/servers/plugins/posix-winsync/posix-winsync.c b/ldap/servers/plugins/posix-winsync/posix-winsync.c
index d43e76d..9a70244 100644
--- a/ldap/servers/plugins/posix-winsync/posix-winsync.c
+++ b/ldap/servers/plugins/posix-winsync/posix-winsync.c
@@ -152,6 +152,9 @@ _check_account_lock(Slapi_Entry *ds_entry, int *isvirt)
     int attr_free_flags = 0;
     char *strval;
 
+    if (isvirt) {
+        *isvirt = 1; /* nsAccountLock is implemeted as nsRole */
+    }
     /* first, see if the attribute is a "real" attribute */
     strval = slapi_entry_attr_get_charptr(ds_entry, "nsAccountLock");
     if (strval) { /* value is real */