如何在Ldap中将用户帐户控制属性固定为512

Question

Using Java code I am trying to crate user in AD LDAP but I am not able to set the userAccountControl status to 512 though I am trying to pass the status as 512 through my code but the user is created with different userAccountControl status as 544.

And when the user is created I am not able to login with his id (DN) and password into LDAP.

I am using the code :

attributes.add(new LDAPAttribute("userAccountControl", "512"));
attributes.add(new LDAPAttribute("userPassword", "Password@1"));

Is there any other way I can set the userAccountControl to 512?

Answer 1

A userAccountControl value of 544 is 512 + 32, which means NORMAL_ACCOUNT + PASSWD_NOTREQD , probably because it doesn't have a password when you created it. You can't set it to 512 if it doesn't have a password.

Setting the password has to be done in a second step, after you create the account. AD is a bit weird in that the userPassword attribute even exists, when it only sometimes behaves as you imagine it should. You can read about that here if you want. But you would be better off just setting unicodePwd instead, which always works the same way, although it is a bit of a weird format.

There is a Java example of doing this here :

public void updateUserPassword(String username, String password)
{
    try
    {
        System.out.println("updating password...\n");
        String quotedPassword = "\"" + password + "\"";
        char unicodePwd[] = quotedPassword.toCharArray();
        byte pwdArray[] = new byte[unicodePwd.length * 2];
        for (int i = 0; i < unicodePwd.length; i++)
        {
            pwdArray[i * 2 + 1] = (byte) (unicodePwd[i] >>> 8);
            pwdArray[i * 2 + 0] = (byte) (unicodePwd[i] & 0xff);
        }
        System.out.print("encoded password: ");
        for (int i = 0; i < pwdArray.length; i++)
        {
            System.out.print(pwdArray[i] + " ");
        }
        System.out.println();
        ModificationItem[] mods = new ModificationItem[1];
        mods[0] = new ModificationItem(DirContext.REPLACE_ATTRIBUTE, new BasicAttribute("UnicodePwd", pwdArray));
        ldapContext.modifyAttributes("cn=" + username + BASE_NAME, mods);
    }
    catch (Exception e)
    {
        System.out.println("update password error: " + e);
    }
}

Note that you must be using LDAPS (LDAP over SSL, usually on port 636) to be able to set the password.

You can set the userAccountControl to 512 in the same request where you set the password.