[python-ldap] Programmatically enable/disable LDAP users from Python?

[Chris Dukes]

nsAccountLock is an operational attribute.  Whether or not you may 
manipulate that via an LDAP connection is up to Oracle.

I suggest contacting Oracle Support instead of us as you are having 
issues with LDAP as implemented by Oracle, not with how python-ldap 
speaks LDAP to another LDAP server.

http://docs.oracle.com/cd/E19225-01/821-0092/bzaoe/index.html

The magic question you need to ask is "How do I disable an LDAP account 
via ldapmodify?"  Once you have that answer you can implement it with 
nearly any API to the LDAP protocol.



On 11/28/2012 02:10 PM, Carolyn Lanser wrote:
>
> Chaos/Peter/Chris-
>
> Thank you for the replies.  I was binding incorrectly (anonymously 
> instead of with an admin dn).
>
> However I am still having issues.  I printed out a user’s attributes 
> before/after using dsutil to disable an account to see what changed, 
> hoping that it would lead to an easy solution.  The only difference I 
> saw was nsAccountLock was present and set to [‘true’] when the account 
> was deactivated.  I tried to simulate this programmatically, but this 
> did not work.  I changed the value of nsAccoutnLock to not be true but 
> dsutil account-status still showed the account as active. Likewise, 
> setting nsAccountLock on an active account was not sufficient to 
> disable an account.
>
> Therefore it seems my assumptions were incorrect.  We are using Oracle 
> Directory Server Enterprise Edition (11.1.1.5.0).    Does anybody have 
> experience programmatically (using Python) enabling/disabling 
> accounts?  Perhaps this is just a Oracle LDAP implementation limitation?
>
> Cheers,
>
> C
>
> ------------------------------------------------------------------------
>
> *From:*Chaos Eternal [mailto:chaoseternal at gmail.com]
>
> Hi,  this depends on which ldap server you are using.
>
> /On Nov 28, 2012 11:39 AM, "Carolyn Lanser" <cll at rincon.com 
> <mailto:cll at rincon.com>> wrote:/
>
> /I would like to programmatically enable/disable LDAP user accounts. 
> From the command prompt I can use dsutil and this apparently 
> sets/removes the nsAccountLock operational attribute. I have attempted 
> to do modify_s() to set and remove this attribute from w/in Python but 
> always get the following error message: "Insufficient 'write' 
> privilege to the 'nsAccountLock' attribute of entry ''"./
>
> /Is there a way to/set/remove/add operational attributes or otherwise 
> enable/disable ldap users programmatically through Python?
>
> /Thanks, C/
>
> ------------------------------------------------------------------------
>
> From: Peter Fisher
>
> Look in your ldap servers slapd.conf (or related conf file) for the 
> ACL that restricts this attribute.
>
> If your ldap server is OpenLDAP you could view:
>
> http://www.openldap.org/doc/admin24/access-control.html
>
>
>
> Cheers,
>
> Peter Fisher.
>
> ------------------------------------------------------------------------
>
> From: Chris Dukes <chris.dukes.aix at gmail.com 
> <mailto:chris.dukes.aix at gmail.com>>
>
> To: python-ldap at python.org <mailto:python-ldap at python.org>
>
> Subject: Re: [python-ldap] Programmatically enable/disable LDAP users
>
>                 from Python?
>
> Message-ID: <50B5899D.80504 at gmail.com <mailto:50B5899D.80504 at gmail.com>>
>
> Content-Type: text/plain; charset="iso-8859-1"; Format="flowed"
>
> You're going to have to read up on ACLs for the LDAP server you're using.
>
> I suspect that you're failing to bind as a privileged user as you did 
> not mention it in your email.  dsutil defaults to $LDAP_ADMIN_USER or 
> cn=Directory Manager, and may further abuse a connection to localhost 
> to determine authority.
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/python-ldap/attachments/20121128/e62a127f/attachment-0001.html>