[Samba] negative ldap filter on AD

[Rowland Penny]

On 01/11/13 02:38, me at electronico.nc wrote:
> Hi all,
>
> Samba 4.1 as AD/DC
> local postfix & dovecot hooked to AD via ldap queries (special user 
> created in AD for that purpose).
>
> Everything works as expected, but :
>
> I'd like inactive users in AD not to be able to read/send emails 
> (understandable I think).
> User status seems (sorry I'm AD newbie) to be controlled by the 
> 'userAccountControl' field in AD.
>
> Created 2 test users in AD : test1 test2
> user test1 has been disabled from WRAT:
>> ldapsearch -LLL -H ldap://localhost:389 -b 
>> 'ou=users,dc=domain,dc=lan' -D 'DOMAIN\ldap' -w 'My_secret_1' 
>> '(&(objectcategory=person)(cn=*)(userAccountControl=66048))' mail 
>> userAccountControl
> ->
>> mail: test2 at domain.lan
>> userAccountControl: 66048
> test2 account is well set to 'disabled' and it returns 66048 value 
> (for a never-expire password)
>

Problem is that 66048 = Enabled, password never expires

>> ldapsearch -LLL -H ldap://localhost:389 -b 
>> 'ou=users,dc=domain,dc=lan' -D 'DOMAIN\ldap' -w 'My_secret_1' 
>> '(&(objectcategory=person)(cn=*)(userAccountControl=66050))' mail 
>> userAccountControl
> ->
>> mail: test1 at domain.lan
>> userAccountControl: 66050
> test1 account is well set to 'enabled' and it returns 66050 value (for 
> a never-expire password)
>

Another problem, 66050 = Disabled, password never expires
> I'd like to setup the LDAP filter in Dovecot to exclude (at least) 
> 66048 value.
> Original filter (query by ldapsearch too) is :
> (&(objectClass=person)(cn=%n)(mail=*))
>
> Tried many syntax (via ldapsearch) but I've been unable to apply a 
> negative condition like:
> (&(objectClass=person)(cn=%n)(mail=*)(!userAccountControl=66050))
> or
> (&(objectClass=person)(cn=%n)(mail=*)(userAccountControl!=66050))
> It always returns :
> ldap_search_ext: Bad search filter (-7)
>
> I've 'googled' and I don't understand why the negative (!) filter is 
> not understood by ldapsearch against AD.
>
> Thanks in advance for your time & lights.
> Nicolas
Try this: (!(userAccountControl:1.2.840.113556.1.4.803:=2) instead of 
this: (userAccountControl!=66050) , this will not find any disabled 
users, that includes 514.

Rowland