Authentication: Delete UTM user-object when deleted from backend server
When we remove a user from our LDAP Directory (namely eDirectory or ActiveDirectory) the User in UTM is untouched. It would be nice if the UTM could know about this and purge its matching user-object as well. (Or display us a report of users who are no longer seen on the backend server so we could trigger a delete periodically).
Michael Good
shared this idea
3 comments
-
ehofstede
commented
Just to keep your UTM "clean"...
-
Ramon Lustrati
commented
This would be a great feature and should be easy to implement, because the astaro is reaching the ldap on a easy way
-
Gert Hansen
commented
The current design requires to create a shadow account of the user from the active directory. The reason for this is, that we create a cert/key pair for this user automatically on the fly which is needed for additional authentication and this information can not be stored in the AD as Astaro never writes to the AD.
But we do NOT store the password of the user in this cached user account. we only cache it for 15min (i think). This means if the disable the account in the AD or remove it from the group, he will NOT be able to log in anymore after 15min, as we do the password authentication against the AD then. If he still can, it is a bug.
regards
Gert
