Simon Says – Musings of a Technology CTO

Following on from my post on Bindings and connector settings, I thought I’d expand on how to use bit-mask searches in the connector Object filter.

Bit-masks are not complex for those who know Boolean arithmetic, and there are a million resources on the web to teach you that, but how to use them in an Active Directory search is obtuse to say the least.

To do a boolean  “AND” search, you use the tag “1.2.840.113556.1.4.803”, to do “OR” the tag is “1.2.840.113556.1.4.804”.

Easy eh? I guess I should give you a practical example. The most likely reason you have to use bit-masks is to exclude disabled users from the connector search. By default, the connector will import them but set their EEM account status to “Disabled”, but you may want simply not to import them in the first place.

If you’re using the ObjectFilter mode of connector operation, you can use a special filter to exclude certain users, including disabled ones) from the results. You can’t though do this if you’re using Search Groups.

Active Directory stores the flag for enabled/disable status in the “userAccountControl” attribute – this is a numeric set of bits indicating things like what type of account it is, whether it’s enabled, whether a smart card is required etc. You can find the full list on Microsoft’s site. Bit 2 of this value indicates if the account is enabled or not.

Illogically perhaps 1 = disabled, 0 = enabled (shouldn’t the value default to disabled?).

so, to do an LDIF search for this bit, to return users who are disabled,  you can use a query like:

(userAccountControl:1.2.840.113556.1.4.803:=2)

and of course, to return the users who are NOT disabled, we just add a not statement at the beginning:

(!userAccountControl:1.2.840.113556.1.4.803:=2)

Much more complex than it should be eh?

Pulling this all together, to make a proper object filter for the EEM AD connector we need to add in the default search which ensures the connector only gets to see “user” objects. We need to simply construct a query which means “tell me about users who are not disabled”:

(&(objectClass=organizationalPerson) _
(!useraccountcontrol:1.2.840.113556.1.4.803:=2))

Voila!