Hey Pedro,

I think observer approach will work. Only thing is, that if you want to call observers from IdentityManager layer, then the "userAccountControls" attribute would need to be available to IdentityManager, so probably will be needed to map it as attribute of User. If it's done 'automatically' at LDAPIdentityStore layer, then "userAccountControls" might be hidden from the API layer. Actually not sure which approach is better, will leave the decision to you