通过ldap python将用户添加到活动目录

Question

I wrote the below code for adding a user to active directory 2012.
I use pycharm and python3.5 but I'm getting this error:

{'info': '000020D6: SvcErr: DSID-0310081B, problem 5012 (DIR_ERROR), data 0\\n', 'desc': 'Operations error'}

My code is as follows:

server = 'ldap://31.184.132.39:389'
ldap_pass = 'function92'
ldap_bind = 'ou=DaaSUsers,dc=xaas,dc=local'

def create_user_activedirectory(username , password , name ):
    username = str(username)
    password=str(password)
    name=str(name)
    con = ldap.initialize(server)
    con.simple_bind_s("administrator@xaas.local", "function92")
    dn = "cn="+username+", ou=DaaSUsers, o=XaaS.local"
    mymodlist = {
         "objectClass": ["account".encode('utf-8'), "posixAccount".encode('utf-8'), "shadowAccount" .encode('utf-8')],
        #"objectClass": [str("inetOrgPerson").encode('utf-8')],
        "cn":[str(name).encode('utf-8')],
        "uid": [str(username).encode('utf-8')],
        "uidNumber": [str("5025").encode('utf-8')],
        "gidNumber": [str("30033").encode('utf-8')],
        "homeDirectory": [str("/home/"+name).encode('utf-8')],
        "loginShell": ["/bin/bash".encode('utf-8')],
        "gecos" : [str(username).encode('utf-8')],
        "userPassword": [password.encode('utf-8')] ,
        "shadowLastChange": [str("0").encode('utf-8')],
        "shadowMax": [str("0").encode('utf-8')],
        "shadowWarning": [str("0").encode('utf-8')],
        "sn": ["De Paepe".encode('utf8')],
        "givenName": ["Maarten".encode('utf8')],
        "displayName": ["Maarten De Paepe".encode('utf8')],
    }
    con.add_s(dn,ldap.modlist.addModlist(mymodlist))
    con.unbind_s()

Please help me.

Answer 1

That error usually means it doesn't like some of the values you are giving it. Here are a couple things I notice, but it may not be everything:

1. The objectClass . Are those classes actually valid in your domain? Do any existing user accounts have those classes? The default classes for a user object are usually "organizationalPerson", "person", "top", and "user". Most of the time, you don't need to actually set this attribute yourself.

2. I don't see you setting sAMAccountName and userPrincipalName . Those are required attributes.