following setup: I am running a kerberos (MIT) and ldap (OpenLDAP) server for single sign on etc. Everything works fine but i have a question regarding inactive users.
I need to find kerberos principals, where the last successful login is beyond a certain time horizon. So far, i haven't been able to find any kind of "listing option for principal arguments" in kadmin. Of course i can go through every principal by typing:
> kadmin: get_principal $princ_name.
and see what pops up. However, this can become very cumbersome for me. Does anyone have a trick/option in mind to speed up the process?
The only alternatives, which are ones I would not prefer, are either to script
> kadmin -p kerb_user -q "get_principal $princ_name",
or to look directly into the log-files on the kerberos server. Maybe somebody has an idea!