Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1868052

Summary: Fix "Manually Inactivating Users and Roles" chapter according to the recent changes
Product: Red Hat Directory Server Reporter: Simon Pichugin <spichugi>
Component: Doc-administration-guideAssignee: Marc Muehlfeld <mmuehlfe>
Status: CLOSED CURRENTRELEASE QA Contact: RHDS QE <ds-qe-bugs>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 11.0CC: rhel-docs
Target Milestone: DS11.1   
Target Release: dirsrv-11.1   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-10-14 09:14:25 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Simon Pichugin 2020-08-11 14:10:23 UTC 
Document URL: 
https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/html/administration_guide/user_account_management-inactivating_users_and_roles

Section Number and Name: 
20.15. Manually Inactivating Users and Roles

Describe the issue: 
Red Hat Directory Server 11 has migrated from Perl to Python tools.

ns-accountstatus.pl, ns-activate.pl and ns-inactivate.pl were ported to lib389 CLI. The functionality was added to dsidm account/role entry-status, dsidm account subtree-status, dsidm role lock/unlock, dsidm account lock/unlock.

https://pagure.io/389-ds-base/issue/50206

Suggestions for improvement: 
Replace the command examples in the Admin guide with new tools.

Additional information: 

To obtain the account status of a single user, you can use the command as follows:

    ns-accountstatus.pl -D "cn=Directory Manager" -w password -I "uid=jsmith,ou=people,dc=example,dc=com"

    dsidm -D "cn=Directory Manager" ldap://server.example.com -b "dc=example,dc=com" account entry-status "uid=jsmith,ou=people,dc=example,dc=com"

Add the -V option to obtain more verbose output:

    dsidm -D "cn=Directory Manager" ldap://server.example.com -b "dc=example,dc=com" account entry-status "uid=jsmith,ou=people,dc=example,dc=com" -V

For example, to inactivate a user account:

    ns-inactivate.pl -Z instance_name -D Directory Manager -w secret -p 389 -h example.com  -I "uid=jfrasier,ou=people,dc=example,dc=com"

    dsidm -D "cn=Directory Manager" ldap://server.example.com -b "dc=example,dc=com" account lock "uid=jfrasier,ou=people,dc=example,dc=com"

Then, the account can be re-activated:

    ns-activate.pl -Z instance_name -D Directory Manager -w secret -p 389 -h example.com  -I "uid=jfrasier,ou=people,dc=example,dc=com"

    dsidm -D "cn=Directory Manager" ldap://server.example.com -b "dc=example,dc=com" account unlock "uid=jfrasier,ou=people,dc=example,dc=com"

Also, it is possible to check a subtree status:

     dsidm -D "cn=Directory Manager" ldap://server.example.com -b "dc=example,dc=com" account subree-status "uid=jsmith,ou=people,dc=example,dc=com"

All of the abve is true for user accounts.

The next command should be used for the roles:

    dsidm -D "cn=Directory Manager" ldap://server.example.com -b "dc=example,dc=com" -h

    usage: dsidm instance role [-h] {list,get-by-dn,modify-by-dn,delete,lock,unlock,entry-status,subtree-status} ...

    positional arguments:
    {list,get-by-dn,modify-by-dn,delete,lock,unlock,entry-status,subtree-status}
                        action
    list                list roles that could login to the directory
    get-by-dn           get-by-dn <dn>
    modify-by-dn        modify-by-dn <dn> <add|delete|replace>:<attribute>:<value> ...
    delete              deletes the role
    lock                lock
    unlock              unlock
    entry-status        status of a single entry
    subtree-status      status of a subtree

    optional arguments:
    -h, --help            show this help message and exit
Comment 1 Marc Muehlfeld 2020-08-13 11:27:34 UTC 
Simon Pichugin, I have updated the following two sections:

http://ccs-jenkins.gsslab.brq.redhat.com:8080/view/Topic%20branches%20-%20Directory%20Server/job/doc-Red_Hat_Directory_Server-Administration_Guide-branch-mmuehlfe_1868052/lastSuccessfulBuild/artifact/tmp/en-US/html-single/index.html#displaying-the-status-of-an-account-or-role

http://ccs-jenkins.gsslab.brq.redhat.com:8080/view/Topic%20branches%20-%20Directory%20Server/job/doc-Red_Hat_Directory_Server-Administration_Guide-branch-mmuehlfe_1868052/lastSuccessfulBuild/artifact/tmp/en-US/html-single/index.html#Inactivating_Users_and_Roles-Inactivating_User_and_Roles_Using_the_Command_Line

Can you please review them? Thanks.

 

One question: The output of "dsidm account entry-status" is the same for me regardless whether I add or omit -V. Is this expected?

And, during testing this feature, I discovered a bug in DS 11.3 nightly: https://pagure.io/389-ds-base/issue/51240
Comment 2 Marc Muehlfeld 2020-10-14 09:14:25 UTC 
I forgot to close this ticket.

The updated sections are meanwhile available on the Customer Portal:
https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/html/administration_guide/user_account_management-inactivating_users_and_roles#displaying-the-status-of-an-account-or-role
https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/html/administration_guide/user_account_management-inactivating_users_and_roles#Inactivating_Users_and_Roles-Inactivating_User_and_Roles_Using_the_Command_Line