“Error of type eDSAuthFailed (-14090)” when attempting to disable a user in Workgroup Manager

In Mac OS Server 10.6, when I select a user account, uncheck the “access account” checkbox, and click Save, I get this error message:

Error of type eDSAuthFailed (-14090) on line 3912 of /SourceCache/WorkgroupManager/WorkgroupManager-361.3.1/Plugins/UserAccounts/UserAdvancedPluginView.mm

It happen for all user accounts I’ve tried. I’m able to make changes to other attributes (e.g., passwords); I just can’t disable accounts.

Any ideas about how to fix this, or to work around it in order to disable user accounts?

Already Tried

• changeip -checkhostname says “The names match. There is nothing to change.”

In Workgroup Manager, there are two levels of authentication: first there’s the “Workgroup Manager Connect” dialog, then there’s the authentication bar just below the main window’s toolbar. For the second authentication, I was diradmin, which was failing. I deleted my Keychain entry for that, restarted Workgroup Manager, then, for the second authentication, authenticated as root. Root was able to successfully disable the user account.

This is strange, because diradmin has the “administer this server” permission, which I would have thought would include permission to disable users.

Check more discussion of this question.