|Jul 3, 2008, 12:54 PM||#1|
Pulling account status en masse (CLI or LDAP) -- apple-user-passwordpolicy?
I've written a rather nice and comprehensive PHP-based frontend for OSX server, however one issue I have is that I can only check whether a user is enabled or disabled one at a time, and only by calling into the server as root and issuing the below command (in this example to check mdavid) and then parsing the line to check if isDisabled=1 (locked) or =0 (unlocked).
pwpolicy -a diradmin -p <diradmin pw> -u mdavid -getpolicy
However, this means in my web user list, I will always list everyone (we have over 2,000 disabled users on our mail server) and on top of that won't be able to show status at least without doing many, many commands.
In best case, I'd be able to get this information from LDAP. I saw in the Apple Open Directory Admin 10.5 2nd Edition manual that there's some attribute called apple-user-passwordpolicy ... but I can't find it anywhere in LDAP! Do I have to do something special to enable this?
Failing that, under linux, the command "passwd -a -S" prints a list of all users and a code P/L (L is locked) as well as pwd expiration data. This style of using one command to get the status for everyone would also be sufficient.
Anyone have any ideas? Any help would be greatly appreciated.
|Jul 3, 2008, 12:57 PM||#2|
Off the top of my head, I would expect "dscl" (directory service command line utility) to be able to get this info.. though I don't know the particulars. Check the man page on it.
|Jul 3, 2008, 01:09 PM||#3|
pwpolicy -a diradmin -u mdavid -setpolicy "isDisabled=0"
dscl /LDAPv3/127.0.0.1 -read /Users/mdavid > mdavid1
pwpolicy -a diradmin -u mdavid -setpolicy "isDisabled=1"
dscl /LDAPv3/127.0.0.1 -read /Users/mdavid > mdavid2
diff mdavid1 mdavid2
This shows no difference (at least in /Users/) between accounts that are locked and unlocked. As for the rest of the directory, I didn't see any information in the other paths that would seem to relate to user status.
|Thread Tools||Search this Thread|
|thread||Thread Starter||Forum||Replies||Last Post|
|Gaddafi's Ministers deserting en masse?||skunk||Politics, Religion, Social Issues||28||Apr 2, 2011 08:23 PM|
|How to make an en (–) or em (—) dash on iPod touch/iPhone?||Sijmen||iPod touch||4||Apr 8, 2008 05:09 PM|
|Moving pictures from Web Gallery (in iPhoto) to Events en masse in iPhoto '08.||JW008||Mac Applications and Mac App Store||1||Feb 14, 2008 05:01 PM|
|Schools ditching laptop programs en masse||Jasonbot||Current Events||28||May 20, 2007 03:30 AM|
|iTunes: Way to change Artist, Album, etc. en masse?||dontmatter||Mac Applications and Mac App Store||7||Apr 16, 2004 02:05 AM|
All times are GMT -5. The time now is 11:31 AM.