1

I am using FreeIPA for Identity access management, i have to provide an active user list (audit requirement). I am using a ldapsearch but i am getting all the user (active+disabled) in the list. Kindly help me to get a user list which exclude disabled users from the list.

Query used: ldapsearch -h -b "cn=users,cn=accounts,dc=example,dc=com" -D "uid=,cn=users,cn=accounts,dc=example,dc=com" -W -x "uid" "gecos" "ntUserLastLogon" "displayName" "employeeType=ENABLED"

Improve this question
2
  • i can help you rewrite your query (by using another search filter) to just display active users, but for that i need the user attributes, can you please show me an example of a inactive user ? (it should have a field like UserActive or something), as your employeetype=enabled does not seem to work
    – olivierg
    Mar 29, 2017 at 17:52
  • Hi, The user have full admin Access :<ID>, users, accounts, ipa.net dn: uid ntUserLastLogon: krbExtraData: krbPasswordExpiration: krbLastPwdChange: krbLastSuccessfulAuth: ipaSshPubKey: mepManagedEntry: cn=<ID> objectClass: top objectClass: person objectClass: organizationalperson objectClass: inetOrgPerson objectClass: ipaSshGroupOfPubKeys objectClass: mepOriginEntry ntUserDeleteAccount: true sn: <SN> givenName: <Name> cn: <Name> ntUserCodePage: 0 ntUserAcctExpires: ntUserDomainId: <ID> ntUniqueId: uid: <ID> krbPrincipalName: <ID>@IPA.NET
    – praveen balehalli
    Apr 3, 2017 at 9:07

2 Answers 2

Reset to default
2

Thanks to olivierg for answer, it saved my day! But there is one minor correction from my side. If you need to exclude disabled users from the ldapsearch returned from freeipa I would recommend to use syntax provided below:

ldapsearch -H ldap://freeipa.example.com -x -W -D "uid=admin,cn=users,cn=accounts,dc=example,dc=com" -b "dc=example,dc=com" "(&(objectClass=person)(!(nsaccountlock=TRUE))(memberOf=cn=pgsql_writers,cn=groups,cn=accounts,dc=example,dc=com))" cn

This query will return pgsql_writers group members (persons only).

Improve this answer
1

Try with "(nsaccountlock=TRUE)" instead of "employeetype=enabled"

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .