I would like to programmatically enable/disable LDAP user accounts. From the command prompt I can use dsutil and this apparently sets/removes the nsAccountLock operational attribute. I have attempted to do modify_s() to set and remove this attribute from w/in Python but always get the following error message: "Insufficient 'write' privilege to the 'nsAccountLock' attribute of entry ''".

Is there a way to set/remove/add operational attributes or otherwise enable/disable ldap users programmatically through Python?

Thanks, C

1 Answer

You should use the attribute 'userAccountControl' which contains a set of control bits.

If you are managing normal users, to enable user:

userAccountControl = 512

and to disable it:

userAccountControl = 514

Generally, if you want to enable/disable an existing user, you should retrieve current value and update it this way.

userADAccountControlFlag = 2 userAccountControl = user.userAccountControl # To enable user: userAccountControl = userAccountControl & ~userADAccountControlFlag # (& bit-wise AND, ~ bit-wise Negate) # To disable user: userAccountControl = userAccountControl | userADAccountControlFlag # (| bit-wise OR) user.userAccountControl = userAccountControl # Then update user on ldap server

you can find more about userAccountControl attribute here:

2

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password

Post as a guest

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.