[Fedora-directory-users] Re: Fedora-directory-users Digest, Vol 42, Issue 4

[Howard Chu]

> Date: Tue, 04 Nov 2008 08:13:08 -0700
> From: Rich Megginson
> John Dickinson wrote:
> > On 30 Oct 2008, at 16:00, Rich Megginson  wrote:
> > create user in AD                    userAccountControl: 512 (Normal)
> > create user in Fedora DS (console)   userAccountControl: 546 (Normal +
> > PASSWD_NOTREQ + ACCOUNTDISABLE)
> >
> > Would there be anything wrong with Fedora DS just forcing
> > userAccountControl = 512? Or are more options needed in the user
> > creation dialog?
>
> I'm not sure.  1.1.3 included a "fix" for userAccountControl.  The way
> it works now is this:
> add new AD entry over LDAP - no userAccountControl attribute is present,
> so it must use some sort of AD default value
> read the new AD entry - get the userAccountControl value
> set AD entry userAccountControl |= 0x200 # 512 == normal account)
>
> So you might try a simple test - add a new AD entry over LDAP outside of
> windows sync - see what the default userAccountControl value is - I'm
> guessing that adding a new AD entry without specifying
> userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE

Yes, users created via LDAP are disabled unless you explicitly provide the 
userAccountControl attribute (with proper flags) in the LDAP Add operation. I 
tripped over this myself the first time I loaded up a test database in AD. (It 
also gave me a Fine Opportunity to time how long it took to LDAP Modify all of 
the users in my test database. ugh...)

[Rich Megginson]

Howard Chu wrote:
> > Date: Tue, 04 Nov 2008 08:13:08 -0700
> > From: Rich Megginson
> > John Dickinson wrote:
> > > On 30 Oct 2008, at 16:00, Rich Megginson  wrote:
> > > create user in AD                    userAccountControl: 512 (Normal)
> > > create user in Fedora DS (console)   userAccountControl: 546 (Normal +
> > > PASSWD_NOTREQ + ACCOUNTDISABLE)
> > >
> > > Would there be anything wrong with Fedora DS just forcing
> > > userAccountControl = 512? Or are more options needed in the user
> > > creation dialog?
> >
> > I'm not sure.  1.1.3 included a "fix" for userAccountControl.  The way
> > it works now is this:
> > add new AD entry over LDAP - no userAccountControl attribute is present,
> > so it must use some sort of AD default value
> > read the new AD entry - get the userAccountControl value
> > set AD entry userAccountControl |= 0x200 # 512 == normal account)
> >
> > So you might try a simple test - add a new AD entry over LDAP outside of
> > windows sync - see what the default userAccountControl value is - I'm
> > guessing that adding a new AD entry without specifying
> > userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE
>
> Yes, users created via LDAP are disabled unless you explicitly provide 
> the userAccountControl attribute (with proper flags) in the LDAP Add 
> operation. I tripped over this myself the first time I loaded up a 
> test database in AD. (It also gave me a Fine Opportunity to time how 
> long it took to LDAP Modify all of the users in my test database. ugh...)

Then this is a bug in the winsync code.  In the ADD case, it should just 
force userAccountControl to the Normal value.  In the MOD case, it 
should |= the value.  John, can you open a bug about this issue?  Thanks.

[David Boreham]

Memory is hazy about this, but I seem to remember that it was done as 
two steps because AD didn't allow userAccountControl to be set in the 
ADD. It had to be set by a separate MOD. Perhaps AD has changed since 
that time in this respect though.

Rich Megginson wrote:
> Howard Chu wrote:
> > > Date: Tue, 04 Nov 2008 08:13:08 -0700
> > > From: Rich Megginson
> > > John Dickinson wrote:
> > > > On 30 Oct 2008, at 16:00, Rich Megginson  wrote:
> > > > create user in AD                    userAccountControl: 512 (Normal)
> > > > create user in Fedora DS (console)   userAccountControl: 546 (Normal +
> > > > PASSWD_NOTREQ + ACCOUNTDISABLE)
> > > >
> > > > Would there be anything wrong with Fedora DS just forcing
> > > > userAccountControl = 512? Or are more options needed in the user
> > > > creation dialog?
> > >
> > > I'm not sure.  1.1.3 included a "fix" for userAccountControl.  The way
> > > it works now is this:
> > > add new AD entry over LDAP - no userAccountControl attribute is 
> > > present,
> > > so it must use some sort of AD default value
> > > read the new AD entry - get the userAccountControl value
> > > set AD entry userAccountControl |= 0x200 # 512 == normal account)
> > >
> > > So you might try a simple test - add a new AD entry over LDAP 
> > > outside of
> > > windows sync - see what the default userAccountControl value is - I'm
> > > guessing that adding a new AD entry without specifying
> > > userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE
> >
> > Yes, users created via LDAP are disabled unless you explicitly 
> > provide the userAccountControl attribute (with proper flags) in the 
> > LDAP Add operation. I tripped over this myself the first time I 
> > loaded up a test database in AD. (It also gave me a Fine Opportunity 
> > to time how long it took to LDAP Modify all of the users in my test 
> > database. ugh...)
>
> Then this is a bug in the winsync code.  In the ADD case, it should 
> just force userAccountControl to the Normal value.  In the MOD case, 
> it should |= the value.  John, can you open a bug about this issue?  
> Thanks.
>
> -- 
> Fedora-directory-users mailing list
> [e-mail]
> https://www.redhat.com/mailman/listinfo/fedora-directory-users

[Rich Megginson]

David Boreham wrote:
> Memory is hazy about this, but I seem to remember that it was done as 
> two steps because AD didn't allow userAccountControl to be set in the 
> ADD. It had to be set by a separate MOD. Perhaps AD has changed since 
> that time in this respect though.

No, I broke this in 1.1.3 - it was working fine in 1.1.2.
> Rich Megginson wrote:
> > Howard Chu wrote:
> > > > Date: Tue, 04 Nov 2008 08:13:08 -0700
> > > > From: Rich Megginson
> > > > John Dickinson wrote:
> > > > > On 30 Oct 2008, at 16:00, Rich Megginson  wrote:
> > > > > create user in AD                    userAccountControl: 512 (Normal)
> > > > > create user in Fedora DS (console)   userAccountControl: 546 
> > > > > (Normal +
> > > > > PASSWD_NOTREQ + ACCOUNTDISABLE)
> > > > >
> > > > > Would there be anything wrong with Fedora DS just forcing
> > > > > userAccountControl = 512? Or are more options needed in the user
> > > > > creation dialog?
> > > >
> > > > I'm not sure.  1.1.3 included a "fix" for userAccountControl.  The way
> > > > it works now is this:
> > > > add new AD entry over LDAP - no userAccountControl attribute is 
> > > > present,
> > > > so it must use some sort of AD default value
> > > > read the new AD entry - get the userAccountControl value
> > > > set AD entry userAccountControl |= 0x200 # 512 == normal account)
> > > >
> > > > So you might try a simple test - add a new AD entry over LDAP 
> > > > outside of
> > > > windows sync - see what the default userAccountControl value is - I'm
> > > > guessing that adding a new AD entry without specifying
> > > > userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE
> > >
> > > Yes, users created via LDAP are disabled unless you explicitly 
> > > provide the userAccountControl attribute (with proper flags) in the 
> > > LDAP Add operation. I tripped over this myself the first time I 
> > > loaded up a test database in AD. (It also gave me a Fine Opportunity 
> > > to time how long it took to LDAP Modify all of the users in my test 
> > > database. ugh...)
> >
> > Then this is a bug in the winsync code.  In the ADD case, it should 
> > just force userAccountControl to the Normal value.  In the MOD case, 
> > it should |= the value.  John, can you open a bug about this issue?  
> > Thanks.
> >
> > -- 
> > Fedora-directory-users mailing list
> > [e-mail]
> > https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
> -- 
> Fedora-directory-users mailing list
> [e-mail]
> https://www.redhat.com/mailman/listinfo/fedora-directory-users