Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Open Directory user that has the "Access Account" box unchecked in Workgroup Manager so they cannot login. Is there a way to determine this using an LDAP query?

It would also be good to be able to check their Login Shell setting for /bin/false via LDAP, as some administrators use that to disable logins.

share|improve this question
up vote 5 down vote accepted

Whether an account is disabled isn't stored in the LDAP database, so you can't get at it with any LDAP query; it's in the password server database, so you need to query the password server. To do this, you first need to get the account's password slot ID, which will be in one of the authAuthority attributes in LDAP, something like this:

authAuthority: ;ApplePasswordServer;0x4ae508585b4ac9840000000500000005,1024 35 

In this example, "0x4ae508585b4ac9840000000500000005" is the user's pasword slot ID. Once you have that, you can connect to the password server and check the user's password policies:

$ telnet 3659
Connected to
Escape character is '^]'.
+OK ApplePasswordServer password server at ready.
getpolicy 0x4ae508585b4ac9840000000500000005
+OK isDisabled=1 isAdminUser=0 newPasswordRequired=0 usingHistory=0
canModifyPasswordforSelf=1 usingExpirationDate=0 usingHardExpirationDate=0
requiresAlpha=0 requiresNumeric=0 expirationDateGMT=44451553867008
hardExpireDateGMT=44451553900288 maxMinutesUntilChangePassword=0
maxMinutesUntilDisabled=0 maxMinutesOfNonUse=0 maxFailedLoginAttempts=0
minChars=0 maxChars=0 passwordCannotBeName=0 requiresMixedCase=0
requiresSymbol=0 notGuessablePattern=0 isSessionKeyAgent=0 isComputerAccount=0
adminClass=0 adminNoChangePasswords=0 adminNoSetPolicies=0 adminNoCreate=0
adminNoDelete=0 adminNoClearState=0 adminNoPromoteAdmins=0
+OK password server signing off.
Connection closed by foreign host.

Note the "isDisabled=1" policy in that list, indicating that this user is currently disabled.

share|improve this answer
Seriously? Geez louise. – geoffc Nov 11 '10 at 3:07
If you're developing using the Open Directory framework in Cocoa, the ODRecord class has a passwordPolicyAndReturnError: method which does this for you. – morgant Feb 20 '13 at 23:46

To find the Login Shell value user:

Search filter of (loginShell=/bin/false) (Though you might need quotes around it since it has slashes in it.

Bind with an LDAP browser like ApacheDS or LBE and look at a user who can and one who cannot login, and look for obvious attributes.

While someone may just know the answer, this way teaches you to fish, instead of handing you a fish. Or else it just stinks like a rotten fish. Your mileage may vary.

share|improve this answer
Thanks, I've been looking for a good LDAP browser and found the LoginShell attribute, but can't see anything like eDirectory's LoginDisabled or Active Directory's userAccountControl to tell me if they aren't allowed to login. – Harley Nov 10 '10 at 4:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.