David Boreham wrote:
Memory is hazy about this, but I seem to remember that it was done as
two steps because AD didn't allow userAccountControl to be set in the
ADD. It had to be set by a separate MOD. Perhaps AD has changed since
that time in this respect though.
No, I broke this in 1.1.3 - it was working fine in 1.1.2.
Rich Megginson wrote:
Howard Chu wrote:
Date: Tue, 04 Nov 2008 08:13:08 -0700
From: Rich Megginson<rmeggins@xxxxxxxxxx>
John Dickinson wrote:
On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins@xxxxxxxxxx> wrote:
create user in AD userAccountControl: 512 (Normal)
create user in Fedora DS (console) userAccountControl: 546
(Normal +
PASSWD_NOTREQ + ACCOUNTDISABLE)
Would there be anything wrong with Fedora DS just forcing
userAccountControl = 512? Or are more options needed in the user
creation dialog?
I'm not sure. 1.1.3 included a "fix" for userAccountControl. The way
it works now is this:
add new AD entry over LDAP - no userAccountControl attribute is
present,
so it must use some sort of AD default value
read the new AD entry - get the userAccountControl value
set AD entry userAccountControl |= 0x200 # 512 == normal account)
So you might try a simple test - add a new AD entry over LDAP
outside of
windows sync - see what the default userAccountControl value is - I'm
guessing that adding a new AD entry without specifying
userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE
Yes, users created via LDAP are disabled unless you explicitly
provide the userAccountControl attribute (with proper flags) in the
LDAP Add operation. I tripped over this myself the first time I
loaded up a test database in AD. (It also gave me a Fine Opportunity
to time how long it took to LDAP Modify all of the users in my test
database. ugh...)
Then this is a bug in the winsync code. In the ADD case, it should
just force userAccountControl to the Normal value. In the MOD case,
it should |= the value. John, can you open a bug about this issue?
Thanks.
--
Fedora-directory-users mailing list
Fedora-directory-users@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-directory-users
--
Fedora-directory-users mailing list
Fedora-directory-users@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-directory-users
--
Fedora-directory-users mailing list
Fedora-directory-users@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-directory-users
