Chapter 9. Manually inactivating users and roles
manually-inactivating-users-and-roles
In Directory Server, you can temporarily inactivate a single user account or a set of accounts. Once an account is inactivated, a user cannot bind to the directory. The authentication operation fails.
9.1. Inactivation and activation of users and roles using the command line
You can manually inactivate users and roles using the command line or the operational attribute.
Roles behave as both a static and a dynamic group. With a group, entries are added to a group entry as members. With a role, the role attribute is added to an entry and then that attribute is used to identify members in the role entry automatically.
Users and roles are inactivated executing the same procedures. However, when a role is inactivated, the members of the role are inactivated, not the role entry itself.
To inactivate users and roles, execute the following commands in the command line:
For inactivation of a user account:
# dsidm -D "cn=Directory Manager" ldap://server.example.com -b "dc=example,dc=com" account lock "uid=user_name,ou=People,dc=example,dc=com"
For inactivation of a role:
# dsidm -D "cn=Directory Manager" ldap://server.example.com -b "dc=example,dc=com" role lock "cn=Marketing,ou=People,dc=example,dc=com"
To activate users and roles, execute the following commands in the command line:
For activation of a user account:
# dsidm -D "cn=Directory Manager" ldap://server.example.com -b "dc=example,dc=com" account unlock "uid=user_name,ou=People,dc=example,dc=com"
For activation of a role:
# dsidm -D "cn=Directory Manager" ldap://server.example.com -b "dc=example,dc=com" role unlock "cn=Marketing,ou=People,dc=example,dc=com"
Optionally, instead of using the commands, you can add the operational attribute nsAccountLock
to the entry. When an entry contains the nsAccountLock
attribute with a value of true
, the server rejects the bind.
9.2. Commands for displaying the status of an account or a role
You can display the status of an account or a role in Directory Server using the corresponding commands in the command line.
Commands for displaying the status
Display the status of an account:
# dsidm -D "cn=Directory Manager" ldap://server.example.com -b "dc=example,dc=com" account entry-status "uid=user_name,ou=People,dc=example,dc=com" Entry DN: uid=user_name,ou=People,dc=example,dc=com Entry Creation Date: 20210813085535Z (2021-08-13 08:55:35) Entry Modification Date: 20210813085535Z (2021-08-13 08:55:35) Entry State: activated
Optional: The
-V
option displays additional details.Example 9.1. Detailed output for an active account
# dsidm -D "cn=Directory Manager" ldap://server.example.com -b "dc=example,dc=com" account entry-status "uid=user_name,ou=People,dc=example,dc=com" -V Entry DN: uid=user_name,ou=People,dc=example,dc=com Entry Creation Date: 20210824160645Z (2021-08-24 16:06:45) Entry Modification Date: 20210824160645Z (2021-08-24 16:06:45) Entry Last Login Date: 20210824160645Z (2021-08-24 16:06:45) Entry Time Until Inactive: 2 seconds (2021-08-24 16:07:45) Entry State: activated
Example 9.2. Detailed output for an inactive account
# dsidm -D "cn=Directory Manager" ldap://server.example.com -b "dc=example,dc=com" account entry-status "uid=user_name,ou=People,dc=example,dc=com" -V Entry DN: uid=user_name,ou=People,dc=example,dc=com Entry Creation Date: 20210824160645Z (2021-08-24 16:06:45) Entry Modification Date: 20210824160645Z (2021-08-24 16:06:45) Entry Last Login Date: 20210824160645Z (2021-08-24 16:06:45) Entry Time Since Inactive: 3 seconds (2021-08-24 16:07:45) Entry State: inactivity limit exceeded
Display the status of a role:
# dsidm -D "cn=Directory Manager" ldap://server.example.com -b "dc=example,dc=com" role entry-status "cn=Marketing,ou=People,dc=example,dc=com" Entry DN: cn=Marketing,ou=people,dc=example,dc=com Entry State: activated
Display the status of a sub-tree:
# dsidm -D "cn=Directory Manager" ldap://server.example.com -b "dc=example,dc=com" account subtree-status "ou=People,dc=example,dc=com" -f "(uid=*)" -V -o "2021-08-25T14:30:30"
To filter the results of the search in a sub-tree, you can use:
-
The
-f
option to set the search filter -
The
-s
option to set the search scope -
The
-i
option to return only inactive accounts -
The
-o
option to return only accounts which will be inactive before the specified dateYYYY-MM-DDTHH:MM:SS
-
The