With a large scale userbase, some method is needed to know about inactive user accounts. Users that don't send/recv mails, users that don't bind/kinit, whatever..
- some kind of attribute is needed to store when was the last activity. - activity would mean a kerberos auth or ldap bind, or an attribute modification. - this last time info needs to be replicated.
This way, a policy like 'purge accounts inactive by 1 year' can be implemented. Or even get a sorted list of user by inactivity time.
I think this is a very nice functionality that FreeIPA should have.
Looking at kerberos attributes would do the trick so a simple ldap search would produce the required result. The only caveat is that the query needs to be run against all servers and results need to be merged.
Metadata Update from @aborrero: - Issue assigned to someone - Issue set to the milestone: Ticket Backlog
Thank you taking time to submit this request for FreeIPA. Unfortunately this bug was not given priority and the team lacks the capacity to work on it at this time.
Given that we are unable to fulfil this request I am closing the issue as wontfix. To request re-consideration of this decision please reopen this issue and provide additional technical details about its importance to you.
Metadata Update from @rcritten: - Issue close_status updated to: wontfix - Issue status updated to: Closed (was: Open)
Login to comment on this ticket.