3

We're experiencing an issue trying to enable a active directory user(windows server 2012 r2) using the net/ldap library.

Setup

First, we create a user via this method:

def create_user(attrs)
  dn = "cn=#{attrs[:cn]},cn=Users,#{@base}"
  cn = attrs[:cn]
  pass = ascii_convert(attrs[:pwd])
  updated_attrs = { cn: cn,
                    objectclass: ['user'],
                    samaccountname: cn,
                    userprincipalname: "#{attrs[:cn]}@#{@domain}",
                    unicodepwd: pass
  }

  @connection.add(dn: dn, attributes: updated_attrs)
  result = @connection.get_operation_result
  raise LdapError.new("Create AD user error: #{result}") if result.code   != 0
end

This creates the user, and by default sets their userAccountControl attribute to 546 (which is what we want), when inspected in active directory this shows as:

0x222 (ACCOUNTDISABLE|PASSWD_NOTREQD|NORMAL_ACCOUNT).

Problem

Later we want to enable that user so we call:

def enable_user!(dn, cn)
  u = search_query(find_user(cn)).try(:first)
  if u
    @connection.replace_attribute(dn, :useraccountcontrol, '512')
  else
    false
  end
end

However, if I print @connection.get_operation_result I get:

<OpenStruct code=53, error_message="0000052D: SvcErr: DSID-031A12D2, problem 5003 (WILL_NOT_PERFORM), data 0\n\u0000", matched_dn="", message="Unwilling to perform">

With this method we want the userAccountControl to equal 512, which is the equivalent of 0x200 (NORMAL_ACCOUNT).

Things I've Tried

notes: connection is over SSL (LDAPS), and bound to an admin AD account.

  • this answer
  • using #modify instead of #replace_attribute in the enable_user! method.
  • passing the hex values instead of the integer representation.
  • perform the same modification using apache directory studio.

One interesting thing I did notice, is that I can modify useraccountcontrol to 514 which is:

0x202 (ACCOUNTDISABLE|NORMAL_ACCOUNT)

So, it seems I can modify this attribute as long as it's remaining disabled, as soon as I try to change to enabled is when I see the error.

4

1 回答 1

1

该错误0000052D是系统错误代码。具体来说，它意味着：

ERROR_PASSWORD_RESTRICTION

1325 (0x52D)

无法更新密码。为新密码提供的值不符合域的长度、复杂性或历史要求。

问题似乎是您正在启用的帐户应用了密码策略，从而使其无法满足密码策略。

我会首先弄清楚该帐户的密码策略是什么，然后将密码设置为符合该策略标准的密码，然后再翻转位以启用它。

但是，如果您确实希望用户无需密码即可登录，则应将密码设置为空。但我不确定在什么情况下是可取的。

于 2016-04-18T21:06:54.190 回答