On Tue, 13 Jun 2023, Alexander Bokovoy via FreeIPA-users wrote:
On Tue, 13 Jun 2023, Sebastian Knust via FreeIPA-users wrote:
Hi,
Is there a way to search for users by krbPrincipalExpiration date
without resorting to direct LDAP queries? We currently use this
attribute to set the end date of employees with fixed-term
contracts. We would like to fire off some offboarding procedures
based on the attribute.
The IPA API/CLI currently does not return any users for searches by
that attribute:
$> ipa --version
VERSION: 4.9.11, API_VERSION: 2.251
$> ipa user-show xredactedx
User login: xredactedx
First name: REDACTED
Last name: REDACTED
Home directory: /home/REDACTED
Login shell: /bin/bash
Principal name: [email protected]
Principal alias: [email protected]
Kerberos principal expiration: 20250801000000Z
[...]
$> ipa user-find --pkey-only --principal-expiration=20250801000000Z
---------------
0 users matched
---------------
----------------------------
Number of entries returned 0
----------------------------
I think it is a bug.
$ ipa user-find --principal-expiration 20220801000000Z
---------------
0 users matched
---------------
----------------------------
Number of entries returned 0
----------------------------
[13/Jun/2023:11:49:56.673338720 +0000] conn=34961 op=2 SRCH base="cn=users,cn=accounts,dc=ipa,dc=test"
scope=1 filter="(&(krbPrincipalExpiration=2022-08-01 00:00:00)(objectClass=posixaccount))"
attrs="givenName loginShell krbPrincipalName nsAccountLock krbPrincipalExpiration krbCanonicalName uid mail
ipaSshPubKey uidNumber telephoneNumber sn gidNumber sshpubkeyfp title homeDirectory"
I.e. we do translate Zulu-formatted date to Python date but when
converting it back to LDAP we don't convert it properly to
Zulu-formatted one. Hence, a search is done using wrong string.
Please open a ticket.
Can you please try the patch from
https://github.com/freeipa/freeipa/pull/6880 ?
You can pick it up as
https://github.com/freeipa/freeipa/pull/6880.patch and update the
corresponding file on your installation, then restart httpd.service on
IPA server.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
