StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>Ok, from toying around with all the ldap connection stuff and having tried several different approaches, like writing the whole show using php-scripts that I executed from within rails, it seems there is actually no real problem in writing the modified value back!</p> <p>What did I do wrong? <strong>Nothing</strong>! ... well ... more or less ... that is ...</p> <p>Why did I fail to realize the above approach 'kind of' worked?</p> <ul> <li>Having the ActiveDirectory SnapIn to see the list of users does not actualize the tiny 'deactivated'-icon when hitting 'F5' ... actually I assumed F5 would actualize the list at all... but it doesn't. So I didn't see the change there.</li> <li>The code above contains a little logical error. Instead of enabling the account it disables and vice versa as the method above assumes the AD-control-flag is called 'Account active' but that is not the case, the flag is 'account deactivated'. So setting the flag means DEACTIVATION which is the opposite of my method above.</li> <li>In addition to the AD-Account-DEACTIVATION-Flag we have a similar flag in our User-Record. My test-user actually was disabled there and the LDAP-Modification was called directly without also setting the user-record setting => so even if the AD-Account was not disabled, my test-user-record still was disabled and did not allow login.</li> <li><p>Last but not least: The return value of the actual attempt to replace the 'userAccountControl'-value kept returning false (and still does in the proper solution given below), even if the modification was successful:</p> <pre><code> success = ldap_con.replace_attribute ldap_encode(@dn), :userAccountControl, ldap_encode(tmpuac.to_s) </code></pre></li> </ul> <p>Here the fixed method to set Account Deactivation (and the value to be written back is expected as a string): </p> <pre><code>def set_account_deactivation(deactivate) get_aduser if @dn.nil? success = false unless @uac.nil? || @uac.blank? tmpuac = @uac.to_i # deactivate = true means 'Account Deactivated'-flag => false tmpuac = deactivate ? tmpuac & 2 == 0 ? tmpuac | 2 # flag not set (active) = account is not deactivated ? deactivate : tmpuac # : leave as is : tmpuac & 2 == 2 ? tmpuac ^ 2 # flag set (deactivated) = account is deactivated ? activate : tmpuac # : leave as is ldap_con = self.class.initialize_ldap_con success = ldap_con.replace_attribute ldap_encode(@dn), :useraccountcontrol, ldap_encode("#{tmpuac}") else puts "Failed to read userAccessControl-Register!" end rescue Net::LDAP::LdapError => e puts "NET::LDAP::LdapError\n#{e}" ensure return success end def ldap_encode(string) if string.encoding.name != 'ASCII-8BIT' string.dup.force_encoding 'ASCII-8BIT' else string end end </code></pre>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload