Comments on: Single sign-on with Linux clients and Active Directory LDAP, Part 1

Comments on: Single sign-on with Linux clients and Active Directory LDAP, Part 1 http://www.evanhoffman.com/evan/2009/12/25/single-sign-on-with-linux-clients-and-active-directory-ldap-part-1/ When 3-nines uptime is just way too much. Sun, 05 Sep 2010 23:21:00 +0000 hourly 1 http://wordpress.org/?v=3.0.1 By: evan http://www.evanhoffman.com/evan/2009/12/25/single-sign-on-with-linux-clients-and-active-directory-ldap-part-1/comment-page-1/#comment-194 evan Fri, 25 Dec 2009 22:14:31 +0000 http://www.evanhoffman.com/evan/?p=271#comment-194 Thanks a lot, Jim! I had seen some of that stuff when I was looking into this, but haven't had time to try it out yet. Thanks a lot, Jim! I had seen some of that stuff when I was looking into this, but haven’t had time to try it out yet.

]]> By: Jim Willeke http://www.evanhoffman.com/evan/2009/12/25/single-sign-on-with-linux-clients-and-active-directory-ldap-part-1/comment-page-1/#comment-193 Jim Willeke Fri, 25 Dec 2009 20:29:26 +0000 http://www.evanhoffman.com/evan/?p=271#comment-193 Microsoft provides a neat trick to work with bitmasks. They have defined a matchingrules. We documented this at: http://ldapwiki.willeke.com/wiki/LDAP%20Query%20using%20a%20bitwise%20filter So putting this to use, you can determine the disabled users with an LDAP filter: http://ldapwiki.willeke.com/wiki/LDAP%20Queries%20AD%20Integration%20Specific#section-LDAP+Queries+AD+Integration+Specific-AllUsersWhoseAccountIsDisabled Now, figure put how to determine if the password it expired is a bit more involved. -jim Microsoft provides a neat trick to work with bitmasks.

They have defined a matchingrules. We documented this at:
http://ldapwiki.willeke.com/wiki/LDAP%20Query%20using%20a%20bitwise%20filter

So putting this to use, you can determine the disabled users with an LDAP filter:
http://ldapwiki.willeke.com/wiki/LDAP%20Queries%20AD%20Integration%20Specific#section-LDAP+Queries+AD+Integration+Specific-AllUsersWhoseAccountIsDisabled

Now, figure put how to determine if the password it expired is a bit more involved.
-jim

]]>