Hello all,

 

We had a very similar issue trying to authenticate Customer accounts against LDAP provided by Windows 2012 R2.   We finally tracked down a solution (worked for us, your results may vary) by modifying the lookup code that checks to see if a user account is enabled.

 

A code snippet from our Config.pm file appears below.   My understanding is that since Win2008 the ‘enabled’ value is no longer stored as a discreet value, but is instead contained in a hash that combines the results of the state of many user account attributes.  I don’t have a deep knowledge of this, but hopefully this can serve as a starting point for further investigation.

 

Code snippet to test for ‘enabled’ state on user account:

 

   # in case you want to add always one filter to each ldap query, use

    # this option. e. g. AlwaysFilter => '(mail=*)' or AlwaysFilter => '(objectclass=user)'

$Self->{'AuthModule::LDAP::AlwaysFilter'} = '(&(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))';

 

 

Thanks,

 

Pat

 

 

 

Raul - sounds like packet capture time…