From 532e679e553b4e1a2744db1b1e62fd883df28e10 Mon Sep 17 00:00:00 2001 From: Orsiris de Jong Date: Tue, 7 Nov 2017 11:46:11 +0100 Subject: [PATCH] Also exclude accounts that don't need passwords Change bitwise filter logic from AND (803) to OR (804) and also filter account bit 32 --- inc/SP/Auth/Ldap/LdapMsAds.class.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inc/SP/Auth/Ldap/LdapMsAds.class.php b/inc/SP/Auth/Ldap/LdapMsAds.class.php index 27587732..108acac6 100644 --- a/inc/SP/Auth/Ldap/LdapMsAds.class.php +++ b/inc/SP/Auth/Ldap/LdapMsAds.class.php @@ -52,7 +52,7 @@ class LdapMsAds extends LdapBase $groupDN = ldap_escape($this->searchGroupDN()); - return '(&(|(memberOf=' . $groupDN . ')(groupMembership=' . $groupDN . ')(memberof:1.2.840.113556.1.4.1941:=' . $groupDN . '))(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(|(objectClass=inetOrgPerson)(objectClass=person)(objectClass=simpleSecurityObject)))'; + return '(&(|(memberOf=' . $groupDN . ')(groupMembership=' . $groupDN . ')(memberof:1.2.840.113556.1.4.1941:=' . $groupDN . '))(!(UserAccountControl:1.2.840.113556.1.4.804:=34))(|(objectClass=inetOrgPerson)(objectClass=person)(objectClass=simpleSecurityObject)))'; } /** @@ -102,7 +102,7 @@ class LdapMsAds extends LdapBase { $userLogin = ldap_escape($this->userLogin); - return '(&(|(samaccountname=' . $userLogin . ')(cn=' . $userLogin . ')(uid=' . $userLogin . '))(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(|(objectClass=inetOrgPerson)(objectClass=person)(objectClass=simpleSecurityObject))(objectCategory=person))'; + return '(&(|(samaccountname=' . $userLogin . ')(cn=' . $userLogin . ')(uid=' . $userLogin . '))(!(UserAccountControl:1.2.840.113556.1.4.804:=34))(|(objectClass=inetOrgPerson)(objectClass=person)(objectClass=simpleSecurityObject))(objectCategory=person))'; } /**