[Fedora-directory-users] Re: WinSync userAccountControl bug (was Fedora-directory-users Digest, Vol 42, Issue 4)

[John Dickinson]

Rich Megginson  wrote:
> Howard Chu wrote:
> > > Date: Tue, 04 Nov 2008 08:13:08 -0700
> > > From: Rich Megginson
> > > John Dickinson wrote:
> > > > On 30 Oct 2008, at 16:00, Rich Megginson   
> > > > wrote:
> > > > create user in AD                    userAccountControl: 512  
> > > > (Normal)
> > > > create user in Fedora DS (console)   userAccountControl: 546  
> > > > (Normal +
> > > > PASSWD_NOTREQ + ACCOUNTDISABLE)
> > > >
> > > > Would there be anything wrong with Fedora DS just forcing
> > > > userAccountControl = 512? Or are more options needed in the user
> > > > creation dialog?
> > >
> > > I'm not sure.  1.1.3 included a "fix" for userAccountControl.  The  
> > > way
> > > it works now is this:
> > > add new AD entry over LDAP - no userAccountControl attribute is  
> > > present,
> > > so it must use some sort of AD default value
> > > read the new AD entry - get the userAccountControl value
> > > set AD entry userAccountControl |= 0x200 # 512 == normal account)
> > >
> > > So you might try a simple test - add a new AD entry over LDAP  
> > > outside of
> > > windows sync - see what the default userAccountControl value is -  
> > > I'm
> > > guessing that adding a new AD entry without specifying
> > > userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE
> >
> > Yes, users created via LDAP are disabled unless you explicitly  
> > provide
> > the userAccountControl attribute (with proper flags) in the LDAP Add
> > operation. I tripped over this myself the first time I loaded up a
> > test database in AD. (It also gave me a Fine Opportunity to time how
> > long it took to LDAP Modify all of the users in my test database.  
> > ugh...)
>
> Then this is a bug in the winsync code.  In the ADD case, it should  
> just
> force userAccountControl to the Normal value.  In the MOD case, it
> should |= the value.  John, can you open a bug about this issue?   
> Thanks.

Done - https://bugzilla.redhat.com/show_bug.cgi?id=470224

There are other values of userAccountControl that an administrator  
might want to set when creating users. One example is  
DONT_EXPIRE_PASSWORD - so is there a need for the userAccountControl  
flags to be configurable on a create user dialog such as that in  
fedora-idm-console or phpldapadmin rather than hard coded?

John

P.S. Sorry about the totally useless subject line earlier in this  
thread.

[Rich Megginson]

John Dickinson wrote:
> Rich Megginson  wrote:
> > Howard Chu wrote:
> > > > Date: Tue, 04 Nov 2008 08:13:08 -0700
> > > > From: Rich Megginson
> > > > John Dickinson wrote:
> > > > > On 30 Oct 2008, at 16:00, Rich Megginson  wrote:
> > > > > create user in AD                    userAccountControl: 512 (Normal)
> > > > > create user in Fedora DS (console)   userAccountControl: 546 
> > > > > (Normal +
> > > > > PASSWD_NOTREQ + ACCOUNTDISABLE)
> > > > >
> > > > > Would there be anything wrong with Fedora DS just forcing
> > > > > userAccountControl = 512? Or are more options needed in the user
> > > > > creation dialog?
> > > >
> > > > I'm not sure.  1.1.3 included a "fix" for userAccountControl.  The way
> > > > it works now is this:
> > > > add new AD entry over LDAP - no userAccountControl attribute is 
> > > > present,
> > > > so it must use some sort of AD default value
> > > > read the new AD entry - get the userAccountControl value
> > > > set AD entry userAccountControl |= 0x200 # 512 == normal account)
> > > >
> > > > So you might try a simple test - add a new AD entry over LDAP 
> > > > outside of
> > > > windows sync - see what the default userAccountControl value is - I'm
> > > > guessing that adding a new AD entry without specifying
> > > > userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE
> > >
> > > Yes, users created via LDAP are disabled unless you explicitly provide
> > > the userAccountControl attribute (with proper flags) in the LDAP Add
> > > operation. I tripped over this myself the first time I loaded up a
> > > test database in AD. (It also gave me a Fine Opportunity to time how
> > > long it took to LDAP Modify all of the users in my test database. 
> > > ugh...)
> >
> > Then this is a bug in the winsync code.  In the ADD case, it should just
> > force userAccountControl to the Normal value.  In the MOD case, it
> > should |= the value.  John, can you open a bug about this issue?  
> > Thanks.
>
> Done - https://bugzilla.redhat.com/show_bug.cgi?id=470224

Thanks.
> There are other values of userAccountControl that an administrator 
> might want to set when creating users. One example is 
> DONT_EXPIRE_PASSWORD - so is there a need for the userAccountControl 
> flags to be configurable on a create user dialog such as that in 
> fedora-idm-console or phpldapadmin rather than hard coded?

Probably, but that's for another bug/enhancement request.
> John
>
> P.S. Sorry about the totally useless subject line earlier in this thread.
>
> -- 
> Fedora-directory-users mailing list
> [e-mail]
> https://www.redhat.com/mailman/listinfo/fedora-directory-users