[Freeipa-users] nsAccountLock attribute

[Martin Kosek]

On 04/01/2015 07:09 AM, Prashant Bapat wrote:
> Hi ,
> 
> Is there a way of making the nsAccountLock attribute (User enable/disable)
> to be anonymously readable ?
> 
> I'm trying to implement a SSH key lookup sshd authorized key command
> script. Based on this attribute the user will be allowed to login. I need
> this to be anonymously readable.
> 
> Tried setting the permissions but it does not work.

Permissions should just work. You can either switch "System: Read User
Addressbook Attributes" permission for anonymous user, with knowing all
consequences it brings to your system, all create a new read permission just
for this attribute.

BTW, note that this attribute is operational and has to be searched out
explicitly in the ldapsearch, e.g.:

# ldapsearch -Y GSSAPI -h `hostname` -b "uid=fbar,cn=users,cn=accounts,dc=f21"
nsaccountlock
SASL/GSSAPI authentication started
SASL username: admin at F21
SASL SSF: 56
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <uid=fbar,cn=users,cn=accounts,dc=f21> with scope subtree
# filter: (objectclass=*)
# requesting: nsaccountlock
#

# fbar, users, accounts, f21
dn: uid=fbar,cn=users,cn=accounts,dc=f21
nsaccountlock: TRUE

# search result
search: 4
result: 0 Success

# numResponses: 2
# numEntries: 1

Final note, new users do not have this attribute until the first time they are
enabled/disabled.

HTH,
Martin