Active Directory users are not handled as expected

Description:

The user handling with Active Directory accounts works not as exepected. If a user was disabled in or removed from the Active Directory, he can still log on to Rocket.Chat. A (manual) LDAP sync does not change anything.

A password change of an Active directory user results in two available logins. The user can log on to Rocket.Chat with the current and the last password. If the user was disabled in the Active Directory he can still log on with his last password (the one before the password change), but the current one does not work anymore.

Server Setup Information:

• Version of Rocket.Chat Server: 0.60.4
• Operating System: Debian 9.3
• Deployment Method(snap/docker/tar/etc): tar
• Number of Running Instances: 1
• DB Replicaset Oplog: -
• Node Version: 8.9.4-1nodesource1
• mongoDB Version: 1:3.2.11-2+deb9u1

Steps to Reproduce:

1. Create an Active Directory user and sync it to Rocket.Chat
2. Test the login
3. Disable Active Directory user
4. Test the login
5. Re-Enable the Active Directory user and change its password two times
6. Test the login with all passwords in history
7. Delete user in the Active Directory
8. Test the login with all passwords in history

Expected behavior:

Disabled or removed users in the Active Directory should lead immediately to a failed login of the user in Rocket.Chat. Password changes should lead to only one working password, all other passwords in history should not work anymore.

Actual behavior:

See description.

Relevant logs:

The issue names no files, tests, or entry points. Start by reproducing the Active Directory disable, deletion, and password-history cases described in the steps, then verify that disabled or removed accounts and previous passwords no longer authenticate.