freeipa

#8197 New accounts do not have the nsaccountlock attribute in ldap
Closed: invalid by frenaud. Opened by mik0s.

Closed: invalid
Reopen Issue

Issue

New accounts do not have the nsaccountlock attribute in ldap. It appears only after the account is disable and back enable.

Steps to Reproduce

  • Create account
# ipa user-add --first test1 --last test1 test1
-----------------------------
Добавлен пользователь «test1»
-----------------------------
  Логин пользователя: test1
  Имя: test1
  Фамилия: test1
  Полное имя: test1 test1
  Отображаемое имя: test1 test1
  Инициалы: tt
  Домашний каталог: /home/test1
  GECOS: test1 test1
  Оболочка входа: /bin/bash
  Principal name: test1@DRW
  Principal alias: test1@DRW
  UID: 961200278
  ID группы: 961200278
  Пароль: False
  Member of groups: ipausers
  Kerberos ключей доступно: False
  • ipa cli show account status correctly
# ipa user-show test1 --raw
  uid: test1
  givenname: test1
  sn: test1
  homedirectory: /home/test1
  loginshell: /bin/bash
  krbcanonicalname: test1@DRW
  krbprincipalname: test1@DRW
  uidnumber: 961200278
  gidnumber: 961200278
  nsaccountlock: FALSE
  has_password: FALSE
  has_keytab: FALSE
  • ldap can't show nsaccountlock attribute
# ldapsearch -LLL -Y GSSAPI -h ipa.drw -b cn=users,cn=accounts,dc=drw "(uid=test1)" nsaccountlock
  • disable this account
# ipa user-disable test1
---------------------------------------------
Учетная запись пользователя «test1» отключена
---------------------------------------------
  • check ldap again and now nsaccountlock is visible
# ldapsearch -LLL -Y GSSAPI -h ipa.drw -b cn=users,cn=accounts,dc=drw "(uid=test1)" nsaccountlock
SASL/GSSAPI authentication started
SASL username: k.mironov@DRW
SASL SSF: 256
SASL data security layer installed.
dn: uid=test1,cn=users,cn=accounts,dc=drw
nsaccountlock: TRUE

Version/Release/Distribution

# rpm -q ipa-server ipa-client 389-ds-base pki-ca krb5-server
ipa-server-4.6.5-11.el7.centos.x86_64
ipa-client-4.6.5-11.el7.centos.x86_64
389-ds-base-1.3.9.1-10.el7.x86_64
pki-ca-10.5.16-3.el7.noarch
krb5-server-1.15.1-37.el7_7.2.x86_64

Hi,
the nsaccountlock attribute is an operational attribute, and is not mandatory in the user entry.
The convention is the following:
- if the attribute is not present, or is present with value False, the user is active.
- if the attribute is present with value True, the user is inactivated.

Directory Server's documentation mentions the following:
**Users and roles are inactivated using the operational attribute nsAccountLock. When an entry contains the nsAccountLock attribute with a value of true, the server rejects the bind. **

If you need to query the status of a specific user, you can use ns-accountstatus.pl command instead of ldapsearch.

Closing as this is not an issue.

Metadata Update from @frenaud:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.