[Freeipa-users] how to list only enabled users using ipa user-find

[Rob Crittenden]

Karl Forner wrote:
> Hello,
> 
> I just realized that "ipa user-find" would list all matching users,
> disregarding their status, i.e. if they are enabled or disabled.
> I could not find a suitable option in "ipa help user-find".
> Is there a way ?
>

I don't recall a way to search for this using IPA tools. You can use
ldapsearch though:

$ ldapsearch -LLL -Y GSSAPI -b cn=users,cn=accounts,dc=example,dc=com
'(nsAccountLock=TRUE)' dn

rob