20.16. Manually Inactivating Users and Roles A single user account or set of accounts can be temporarily inactivated. Once an account is inactivated, a user cannot bind to the directory. The authentication operation will fail. Users and roles are inactivated using the operational attribute nsAccountLock . When an entry contains the nsAccountLock attribute with a value of true , the server rejects the bind. The same procedures are used to inactivate users and roles. However, when a role is inactivated, the members of the role are inactivated, not the role entry itself. For more information about roles in general and how roles interact with access control in particular, see Chapter 8, Organizing and Grouping Entries . Warning The root entry (the entry corresponding to the root or sub suffix) on a database cannot be inactivated. Chapter 3, Managing Directory Entries has information on creating the entry for a root or sub suffix, and Chapter 2, Configuring Directory Databases has information on creating root and sub suffixes. 20.16.1. Displaying the Status of an Account or Role To display the status of: An account, enter: Optional: Pass the -V option to the command to display additional details: The output is an example of an active account, as indicated by the last two lines of the output. An inactive account would instead provide output similar to the following: A role, enter: To display the status of a sub-tree instead of an entry, use the subtree-status instead of the entry-status option. When you use the subtree-status option, you can specify a filter ( -f ) and a search scope ( -s) to narrow down the results. Additionally, you can refine the search using the -i option to return only inactive accounts or the -o date option to return only accounts which will be inactive before the specified date: Specify the date in the following format: YYYY-MM-DD T HH:MM:SS 20.16.2. Inactivating and Activating Users and Roles Using the Command Line To inactivate: A user account, enter: A role, enter: To activate: A user account, enter: A role, enter:

Commands:
dsidm -D "cn=Directory Manager" ldap://server.example.com -b " dc=example,dc=com " account entry-status " uid=user_name,ou=People,dc=example,dc=com " Entry DN: uid=user_name,ou=People,dc=example,dc=com Entry Creation Date: 20200813085535Z (2020-08-13 08:55:35) Entry Modification Date: 20200813085535Z (2020-08-13 08:55:35) Entry State: activated
dsidm -D "cn=Directory Manager" ldap://server.example.com -b " dc=example,dc=com " account entry-status " uid=user_name,ou=People,dc=example,dc=com " -V Entry DN: uid=user_name,ou=People,dc=example,dc=com Entry Creation Date: 20200824160645Z (2020-08-24 16:06:45) Entry Modification Date: 20200824160645Z (2020-08-24 16:06:45) Entry Last Login Date: 20200824160645Z (2020-08-24 16:06:45) Entry Time Until Inactive: 2 seconds (2020-08-24 16:07:45) Entry State: activated
dsidm -D "cn=Directory Manager" ldap://server.example.com -b " dc=example,dc=com " account entry-status " uid=user_name,ou=People,dc=example,dc=com " -V Entry DN: uid=user_name,ou=People,dc=example,dc=com Entry Creation Date: 20200824160645Z (2020-08-24 16:06:45) Entry Modification Date: 20200824160645Z (2020-08-24 16:06:45) Entry Last Login Date: 20200824160645Z (2020-08-24 16:06:45) Entry Time Since Inactive: 3 seconds (2020-08-24 16:07:45) Entry State: inactivity limit exceeded
dsidm -D "cn=Directory Manager" ldap://server.example.com -b " dc=example,dc=com " role entry-status " cn=Marketing,ou=People,dc=example,dc=com " Entry DN: cn=Marketing,ou=people,dc=example,dc=com Entry State: activated
dsidm -D "cn=Directory Manager" ldap://server.example.com -b " dc=example,dc=com " account account " ou=People,dc=example,dc=com " -f " (uid=*) " -V -o " 2020-08-25T14:30:30 "
dsidm -D "cn=Directory Manager" ldap://server.example.com -b " dc=example,dc=com " account lock " uid=user_name,ou=People,dc=example,dc=com
dsidm -D "cn=Directory Manager" ldap://server.example.com -b " dc=example,dc=com " role lock " cn=Marketing,ou=People,dc=example,dc=com
dsidm -D "cn=Directory Manager" ldap://server.example.com -b " dc=example,dc=com " account unlock " uid=user_name,ou=People,dc=example,dc=com
dsidm -D "cn=Directory Manager" ldap://server.example.com -b " dc=example,dc=com " role unlock " cn=Marketing,ou=People,dc=example,dc=com