[Fedora-directory-users] Re: WinSync userAccountControl bug (was Fedora-directory-users Digest, Vol 42, Issue 4)

[John Dickinson]

Rich Megginson <rmeggins at redhat.com> wrote:

> Howard Chu wrote:
>>> Date: Tue, 04 Nov 2008 08:13:08 -0700
>>> From: Rich Megginson<rmeggins at redhat.com>
>>
>>> John Dickinson wrote:
>>>> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins at redhat.com>   
>>>> wrote:
>>
>>>> create user in AD                    userAccountControl: 512  
>>>> (Normal)
>>>> create user in Fedora DS (console)   userAccountControl: 546  
>>>> (Normal +
>>>> PASSWD_NOTREQ + ACCOUNTDISABLE)
>>>>
>>>> Would there be anything wrong with Fedora DS just forcing
>>>> userAccountControl = 512? Or are more options needed in the user
>>>> creation dialog?
>>> I'm not sure.  1.1.3 included a "fix" for userAccountControl.  The  
>>> way
>>> it works now is this:
>>> add new AD entry over LDAP - no userAccountControl attribute is  
>>> present,
>>> so it must use some sort of AD default value
>>> read the new AD entry - get the userAccountControl value
>>> set AD entry userAccountControl |= 0x200 # 512 == normal account)
>>>
>>> So you might try a simple test - add a new AD entry over LDAP  
>>> outside of
>>> windows sync - see what the default userAccountControl value is -  
>>> I'm
>>> guessing that adding a new AD entry without specifying
>>> userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE
>>
>> Yes, users created via LDAP are disabled unless you explicitly  
>> provide
>> the userAccountControl attribute (with proper flags) in the LDAP Add
>> operation. I tripped over this myself the first time I loaded up a
>> test database in AD. (It also gave me a Fine Opportunity to time how
>> long it took to LDAP Modify all of the users in my test database.  
>> ugh...)
>>
> Then this is a bug in the winsync code.  In the ADD case, it should  
> just
> force userAccountControl to the Normal value.  In the MOD case, it
> should |= the value.  John, can you open a bug about this issue?   
> Thanks.

Done - https://bugzilla.redhat.com/show_bug.cgi?id=470224

There are other values of userAccountControl that an administrator  
might want to set when creating users. One example is  
DONT_EXPIRE_PASSWORD - so is there a need for the userAccountControl  
flags to be configurable on a create user dialog such as that in  
fedora-idm-console or phpldapadmin rather than hard coded?

John

P.S. Sorry about the totally useless subject line earlier in this  
thread.