8000 Do not rely on the pwdLastSet attribute when updating AD entries by pedroigor · Pull Request #34470 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

Do not rely on the pwdLastSet attribute when updating AD entries #34470

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ahus1 merged 1 commit into from
Oct 30, 2024
Merged

Do not rely on the pwdLastSet attribute when updating AD entries #34470

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8000
8 changes: 8 additions & 0 deletions docs/documentation/release_notes/topics/26_1_0.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,3 +8,11 @@ If you are using a custom theme that extends any of the `keycloak` themes and ar
----
darkMode=false
----

= LDAP users are created as enabled by default when using Microsoft Active Directory

If you are using Microsoft AD and creating users through the administrative interfaces, the user will created as enabled by default.

In previous versions, it was only possible to update the user status after setting a (non-temporary) password to the user.
This behavior was not consistent with other built-in user storages as well as not consistent with others LDAP vendors supported
by the LDAP provider.
3 changes: 1 addition & 2 deletions federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,6 @@
import org.keycloak.models.utils.reflection.Property;
import org.keycloak.models.utils.reflection.PropertyCriteria;
import org.keycloak.models.utils.reflection.PropertyQueries;
import org.keycloak.storage.ldap.LDAPConfig;
import org.keycloak.storage.ldap.idm.model.LDAPDn;
import org.keycloak.storage.ldap.idm.model.LDAPObject;
import org.keycloak.storage.ldap.idm.query.Condition;
Expand Down Expand Up @@ -373,7 +372,7 @@ public static void fillRangedAttribute(LDAPStorageProvider ldapProvider, LDAPObj
* Map key are the attributes names in lower case
*/
public static Map<String, Property<Object>> getUserModelProperties(){

Map<String, Property<Object>> userModelProps = PropertyQueries.createQuery(UserModel.class)
.addCriteria(new PropertyCriteria() {

Expand Down
2 changes: 1 addition & 1 deletion ...main/java/org/keycloak/storage/ldap/mappers/msad/MSADUserAccountControlStorageMapper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -248,7 +248,7 @@ public boolean isEnabled() {

@Override
public void setEnabled(boolean enabled) {
if (ldapProvider.getEditMode() == UserStorageProvider.EditMode.WRITABLE && getPwdLastSet() > 0) {
if (UserStorageProvider.EditMode.WRITABLE.equals(ldapProvider.getEditMode())) {
MSADUserAccountControlStorageMapper.logger.debugf("Going to propagate enabled=%s for ldapUser '%s' to MSAD", enabled, ldapUser.getDn().toString());

UserAccountControl control = getUserAccountControl(ldapUser);
Expand Down
0