Memory is hazy about this, but I seem to remember that it was done as two steps because AD didn't allow userAccountControl to be set in the ADD. It had to be set by a separate MOD. Perhaps AD has changed since that time in this respect though. Rich Megginson wrote: > Howard Chu wrote: >>> Date: Tue, 04 Nov 2008 08:13:08 -0700 >>> From: Rich Megginson<rmeggins at redhat.com> >> >>> John Dickinson wrote: >>>> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins at redhat.com> wrote: >> >>>> create user in AD userAccountControl: 512 (Normal) >>>> create user in Fedora DS (console) userAccountControl: 546 (Normal + >>>> PASSWD_NOTREQ + ACCOUNTDISABLE) >>>> >>>> Would there be anything wrong with Fedora DS just forcing >>>> userAccountControl = 512? Or are more options needed in the user >>>> creation dialog? >>> I'm not sure. 1.1.3 included a "fix" for userAccountControl. The way >>> it works now is this: >>> add new AD entry over LDAP - no userAccountControl attribute is >>> present, >>> so it must use some sort of AD default value >>> read the new AD entry - get the userAccountControl value >>> set AD entry userAccountControl |= 0x200 # 512 == normal account) >>> >>> So you might try a simple test - add a new AD entry over LDAP >>> outside of >>> windows sync - see what the default userAccountControl value is - I'm >>> guessing that adding a new AD entry without specifying >>> userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE >> >> Yes, users created via LDAP are disabled unless you explicitly >> provide the userAccountControl attribute (with proper flags) in the >> LDAP Add operation. I tripped over this myself the first time I >> loaded up a test database in AD. (It also gave me a Fine Opportunity >> to time how long it took to LDAP Modify all of the users in my test >> database. ugh...) >> > Then this is a bug in the winsync code. In the ADD case, it should > just force userAccountControl to the Normal value. In the MOD case, > it should |= the value. John, can you open a bug about this issue? > Thanks. > > -- > Fedora-directory-users mailing list > Fedora-directory-users at redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users
