Enable/Disable Account Programmatically Using Python Ldap Module?
I Would Like to Programmatically Enable/Disable Ldap User Accounts. from the Command Prompt I Can Use Dsutil and This Apparently Sets/Removes the nsAccountLock...
I would like to programmatically enable/disable LDAP user accounts. From the command prompt I can use dsutil and this apparently sets/removes the nsAccountLock operational attribute. I have attempted to do modify_s() to set and remove this attribute from w/in Python but always get the following error message: "Insufficient 'write' privilege to the 'nsAccountLock' attribute of entry ''".
Is there a way to set/remove/add operational attributes or otherwise enable/disable ldap users programmatically through Python?
Thanks, C
1 Answer
You should use the attribute 'userAccountControl' which contains a set of control bits.
If you are managing normal users, to enable user:
userAccountControl = 512
and to disable it:
userAccountControl = 514
Generally, if you want to enable/disable an existing user, you should retrieve current value and update it this way.
userADAccountControlFlag = 2
userAccountControl = user.userAccountControl
# To enable user:
userAccountControl = userAccountControl & ~userADAccountControlFlag # (& bit-wise AND, ~ bit-wise Negate)
# To disable user:
userAccountControl = userAccountControl | userADAccountControlFlag # (| bit-wise OR)
user.userAccountControl = userAccountControl
# Then update user on ldap server
you can find more about userAccountControl attribute here:
Alexander Ross has covered the video game industry for a decade, writing deep dives on game design, esports tournaments, VR developments, and gaming culture.
