userAccountControl's ACCOUNTDISABLE (AD).
OptionaldisplayOptionalemailEvery attribute read.
accountExpires (AD); null when it never expires.
OptionalgivenOptionalgroupsWith authenticate(…, { groups }): its groups.
OptionalidobjectGUID (AD) or entryUUID (OpenLDAP): it does not change when the user is renamed or moved.
A lockoutTime (AD) or a pwdAccountLockedTime (OpenLDAP's ppolicy).
The DNs of the groups it is a direct member of (memberOf).
OptionalsidobjectSid (AD).
OptionalsurnamesAMAccountName (AD) or uid (OpenLDAP).
Optionaluser
A user of the directory.