Chapter 9. Manually inactivating users and roles manually-inactivating-users-and-roles In Directory Server, you can temporarily inactivate a single user account or a set of accounts. Once an account is inactivated, a user cannot bind to the directory. The authentication operation fails. 9.1. Inactivation and activation of users and roles using the command line You can manually inactivate users and roles using the command line or the operational attribute. Roles behave as both a static and a dynamic group. With a group, entries are added to a group entry as members. With a role, the role attribute is added to an entry and then that attribute is used to identify members in the role entry automatically. Users and roles are inactivated executing the same procedures. However, when a role is inactivated, the members of the role are inactivated, not the role entry itself. To inactivate users and roles, execute the following commands in the command line: For inactivation of a user account: # dsidm -D " cn=Directory Manager " ldap://server.example.com -b " dc=example,dc=com " account lock " uid=user_name,ou=People,dc=example,dc=com " For inactivation of a role: # dsidm -D " cn=Directory Manager " ldap://server.example.com -b " dc=example,dc=com " role lock " cn=Marketing,ou=People,dc=example,dc=com " To activate users and roles, execute the following commands in the command line: For activation of a user account: # dsidm -D " cn=Directory Manager " ldap://server.example.com -b " dc=example,dc=com " account unlock " uid=user_name,ou=People,dc=example,dc=com " For activation of a role: # dsidm -D " cn=Directory Manager " ldap://server.example.com -b " dc=example,dc=com " role unlock " cn=Marketing,ou=People,dc=example,dc=com " Optionally, instead of using the commands, you can add the operational attribute nsAccountLock to the entry. When an entry contains the nsAccountLock attribute with a value of true , the server rejects the bind. Additional resources Using roles in Directory Server Managing directory attributes and values Configuring directory databases 9.2. Commands for displaying the status of an account or a role You can display the status of an account or a role in Directory Server using the corresponding commands in the command line. Commands for displaying the status Display the status of an account: # dsidm -D " cn=Directory Manager " ldap://server.example.com -b " dc=example,dc=com " account entry-status " uid=user_name,ou=People,dc=example,dc=com " Entry DN: uid=user_name,ou=People,dc=example,dc=com Entry Creation Date: 20210813085535Z (2021-08-13 08:55:35) Entry Modification Date: 20210813085535Z (2021-08-13 08:55:35) Entry State: activated Optional: The -V option displays additional details. Example 9.1. Detailed output for an active account # dsidm -D " cn=Directory Manager " ldap://server.example.com -b " dc=example,dc=com " account entry-status " uid=user_name,ou=People,dc=example,dc=com " -V Entry DN: uid=user_name,ou=People,dc=example,dc=com Entry Creation Date: 20210824160645Z (2021-08-24 16:06:45) Entry Modification Date: 20210824160645Z (2021-08-24 16:06:45) Entry Last Login Date: 20210824160645Z (2021-08-24 16:06:45) Entry Time Until Inactive: 2 seconds (2021-08-24 16:07:45) Entry State: activated Example 9.2. Detailed output for an inactive account # dsidm -D " cn=Directory Manager " ldap://server.example.com -b " dc=example,dc=com " account entry-status " uid=user_name,ou=People,dc=example,dc=com " -V Entry DN: uid=user_name,ou=People,dc=example,dc=com Entry Creation Date: 20210824160645Z (2021-08-24 16:06:45) Entry Modification Date: 20210824160645Z (2021-08-24 16:06:45) Entry Last Login Date: 20210824160645Z (2021-08-24 16:06:45) Entry Time Since Inactive: 3 seconds (2021-08-24 16:07:45) Entry State: inactivity limit exceeded Display the status of a role: # dsidm -D " cn=Directory Manager " ldap://server.example.com -b " dc=example,dc=com " role entry-status " cn=Marketing,ou=People,dc=example,dc=com " Entry DN: cn=Marketing,ou=people,dc=example,dc=com Entry State: activated Display the status of a sub-tree: # dsidm -D " cn=Directory Manager " ldap://server.example.com -b " dc=example,dc=com " account subtree-status " ou=People,dc=example,dc=com " -f " (uid=*) " -V -o " 2021-08-25T14:30:30 " To filter the results of the search in a sub-tree, you can use: The -f option to set the search filter The -s option to set the search scope The -i option to return only inactive accounts The -o option to return only accounts which will be inactive before the specified date YYYY-MM-DDTHH:MM:SS

Commands:
dsidm -D " cn=Directory Manager " ldap://server.example.com -b " dc=example,dc=com " account lock " uid=user_name,ou=People,dc=example,dc=com "
dsidm -D " cn=Directory Manager " ldap://server.example.com -b " dc=example,dc=com " role lock " cn=Marketing,ou=People,dc=example,dc=com "
dsidm -D " cn=Directory Manager " ldap://server.example.com -b " dc=example,dc=com " account unlock " uid=user_name,ou=People,dc=example,dc=com "
dsidm -D " cn=Directory Manager " ldap://server.example.com -b " dc=example,dc=com " role unlock " cn=Marketing,ou=People,dc=example,dc=com "
dsidm -D " cn=Directory Manager " ldap://server.example.com -b " dc=example,dc=com " account entry-status " uid=user_name,ou=People,dc=example,dc=com " Entry DN: uid=user_name,ou=People,dc=example,dc=com Entry Creation Date: 20210813085535Z (2021-08-13 08:55:35) Entry Modification Date: 20210813085535Z (2021-08-13 08:55:35) Entry State: activated
dsidm -D " cn=Directory Manager " ldap://server.example.com -b " dc=example,dc=com " account entry-status " uid=user_name,ou=People,dc=example,dc=com " -V Entry DN: uid=user_name,ou=People,dc=example,dc=com Entry Creation Date: 20210824160645Z (2021-08-24 16:06:45) Entry Modification Date: 20210824160645Z (2021-08-24 16:06:45) Entry Last Login Date: 20210824160645Z (2021-08-24 16:06:45) Entry Time Until Inactive: 2 seconds (2021-08-24 16:07:45) Entry State: activated
dsidm -D " cn=Directory Manager " ldap://server.example.com -b " dc=example,dc=com " account entry-status " uid=user_name,ou=People,dc=example,dc=com " -V Entry DN: uid=user_name,ou=People,dc=example,dc=com Entry Creation Date: 20210824160645Z (2021-08-24 16:06:45) Entry Modification Date: 20210824160645Z (2021-08-24 16:06:45) Entry Last Login Date: 20210824160645Z (2021-08-24 16:06:45) Entry Time Since Inactive: 3 seconds (2021-08-24 16:07:45) Entry State: inactivity limit exceeded
dsidm -D " cn=Directory Manager " ldap://server.example.com -b " dc=example,dc=com " role entry-status " cn=Marketing,ou=People,dc=example,dc=com " Entry DN: cn=Marketing,ou=people,dc=example,dc=com Entry State: activated
dsidm -D " cn=Directory Manager " ldap://server.example.com -b " dc=example,dc=com " account subtree-status " ou=People,dc=example,dc=com " -f " (uid=*) " -V -o " 2021-08-25T14:30:30 "