active users by attribute, not by group

[codepypl]

Can I filter users for example are they active not by group , but by an atribute?

[creshal]

That should be doable with an appropriate AUTH_LDAP_USER_SEARCH query, e.g. "(&(uid=%(user)s)(custom_active_user_attribute=true)".

For Google Secure LDAP in particular we use "(&(uid=%(user)s)(suspended=false)".

[sevdog]

This will be useful when interacting with Microsoft AD, since there are a couple of attributes which may not be filtered easyly.

As example the sssd-ldap maps two attributes of AD to detect if the user is active, which (by default) are:

• userAccountControl which is a binary set of flags
• accountExpires whish is an integer representing a date

These attributes cannot be compared with a fixed search.