Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an Open Directory user that has the "Access Account" box unchecked in Workgroup Manager so they cannot login. Is there a way to determine this using an LDAP query?

It would also be good to be able to check their Login Shell setting for /bin/false via LDAP, as some administrators use that to disable logins.

share|improve this question

2 Answers 2

up vote 5 down vote accepted

Whether an account is disabled isn't stored in the LDAP database, so you can't get at it with any LDAP query; it's in the password server database, so you need to query the password server. To do this, you first need to get the account's password slot ID, which will be in one of the authAuthority attributes in LDAP, something like this:

authAuthority: ;ApplePasswordServer;0x4ae508585b4ac9840000000500000005,1024 35 
 1484429831226030758363098280788558407709702186716704057921377682138163682495133
 1971257473356121601282837516549920614867084718242948054970731529476886852497051
 1771493871066923475105955010041662310891335912128945258881795910315183596873989
 2049755102190782235854169470422244680045551515607049216054651273928793669 
 root@myserver.example.com:10.0.0.5

In this example, "0x4ae508585b4ac9840000000500000005" is the user's pasword slot ID. Once you have that, you can connect to the password server and check the user's password policies:

$ telnet 10.0.0.5 3659
Trying 10.0.0.5...
Connected to myserver.example.com.
Escape character is '^]'.
+OK ApplePasswordServer 10.6.0.0 password server at 10.1.0.1 ready.
getpolicy 0x4ae508585b4ac9840000000500000005
+OK isDisabled=1 isAdminUser=0 newPasswordRequired=0 usingHistory=0
canModifyPasswordforSelf=1 usingExpirationDate=0 usingHardExpirationDate=0
requiresAlpha=0 requiresNumeric=0 expirationDateGMT=44451553867008
hardExpireDateGMT=44451553900288 maxMinutesUntilChangePassword=0
maxMinutesUntilDisabled=0 maxMinutesOfNonUse=0 maxFailedLoginAttempts=0
minChars=0 maxChars=0 passwordCannotBeName=0 requiresMixedCase=0
requiresSymbol=0 notGuessablePattern=0 isSessionKeyAgent=0 isComputerAccount=0
adminClass=0 adminNoChangePasswords=0 adminNoSetPolicies=0 adminNoCreate=0
adminNoDelete=0 adminNoClearState=0 adminNoPromoteAdmins=0
quit
+OK password server signing off.
Connection closed by foreign host.

Note the "isDisabled=1" policy in that list, indicating that this user is currently disabled.

share|improve this answer
    
Seriously? Geez louise. –  geoffc Nov 11 '10 at 3:07
    
If you're developing using the Open Directory framework in Cocoa, the ODRecord class has a passwordPolicyAndReturnError: method which does this for you. –  morgant Feb 20 '13 at 23:46

To find the Login Shell value user:

Search filter of (loginShell=/bin/false) (Though you might need quotes around it since it has slashes in it.

Bind with an LDAP browser like ApacheDS or LBE and look at a user who can and one who cannot login, and look for obvious attributes.

While someone may just know the answer, this way teaches you to fish, instead of handing you a fish. Or else it just stinks like a rotten fish. Your mileage may vary.

share|improve this answer
    
Thanks, I've been looking for a good LDAP browser and found the LoginShell attribute, but can't see anything like eDirectory's LoginDisabled or Active Directory's userAccountControl to tell me if they aren't allowed to login. –  Harley Nov 10 '10 at 4:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.