[Freeipa-users] MemberOf plugin keeps disabling account

[Rob Crittenden]

James Roman wrote:
> I have a single account that keeps getting disabled by the memberOf 
> Plugin, even though it is disabled.

[ SNIP ]

> Am I missing something? What do I need to do to get the MemeberOf plugin 
> from stepping on our changes?  We have FreeIPA 1.2.2 and 389-DS 1.2.5 on 
> FC11.

I don't think you want to disable memberof, it will probably break other 
stuff. I'm guessing you did this to see what would happen. Did you 
restart the DS after disabling it? I believe that is required.

How are you unlocking the user, using the ipa-lockuser tool?

I should note that a user doesn't need to be in cn=activated to be 
unlocked, they just need to not be in cn=inactivated. The cn=activated 
is there so you can disable a group (which will in turn inactivate all 
members of that group) and then go back and set some group members to be 
re-activated.

rob