<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# User Access Reviews — API Reference

## ldap3 (Active Directory)

```python
from ldap3 import Server, Connection, ALL, SUBTREE

# Connect and search
server = Server("ldap://dc01.corp.local", get_info=ALL)
conn = Connection(server, "CN=svc_audit,OU=Service,DC=corp,DC=local", "password", auto_bind=True)

# All users with group memberships
conn.search("DC=corp,DC=local", "(objectClass=user)",
    search_scope=SUBTREE,
    attributes=["sAMAccountName", "memberOf", "userAccountControl", "lastLogonTimestamp"])

# Check if account disabled (UAC flag 0x2)
disabled = bool(int(str(entry.userAccountControl)) & 0x2)
```

## Microsoft Graph API (Azure AD)

```bash
# List users
curl -H "Authorization: Bearer $TOKEN" "https://graph.microsoft.com/v1.0/users?\$select=displayName,accountEnabled,lastSignInDateTime"

# User group memberships
curl -H "Authorization: Bearer $TOKEN" "https://graph.microsoft.com/v1.0/users/{id}/memberOf"

# List role assignments
curl -H "Authorization: Bearer $TOKEN" "https://graph.microsoft.com/v1.0/directoryRoles/{id}/members"
```

## Common SoD Conflict Pairs

| Role A | Role B | Risk |
|--------|--------|------|
| Accounts Payable | Accounts Receivable | Financial fraud |
| System Admin | Security Admin | Unchecked privilege |
| Developer | Production Deploy | Unauthorized changes |
| HR Admin | Payroll Approver | Payroll fraud |
| DBA | Application Owner | Data manipulation |

## UserAccountControl Flags

| Flag | Value | Meaning |
|------|-------|---------|
| ACCOUNTDISABLE | 0x0002 | Account disabled |
| LOCKOUT | 0x0010 | Account locked |
| PASSWD_NOTREQD | 0x0020 | No password required |
| DONT_EXPIRE_PASSWORD | 0x10000 | Password never expires |

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Review completed, no violations |
| 1 | SoD violations or orphaned accounts found |
| 2 | Runtime error or LDAP connection failure |
