ldap-disableuser.erb

#!/bin/bash

if [ "$#" -ne 1 ] || [ "$1" = "-h" ] || [ "$1" = "--help" ]; then
  echo "Usage: $0 USERNAME" >&2
  exit 1
fi

confirm () {
    # call with a prompt string or use a default
    echo "This will disable the $USERNAME account."
    read -r -p "This is irreversible. Are you sure? [y/N] " response
    case $response in
        [yY][eE][sS]|[yY]) 
            true
            ;;
        *)
            false
            ;;
    esac
}


USERNAME=$1
NEWPASSWORD="`openssl rand -base64 24`"
BINDUSER="cn=Directory Manager"
BINDPW=DirManPassWord
LDAPHOST=ldap.example.org

confirm && echo \
"dn: uid=$USERNAME,ou=People,dc=example,dc=org
changetype: modify
replace: userPassword
userPassword: $NEWPASSWORD
-
replace: gecos
gecos: DISABLED DISABLED
-
replace: loginShell
loginShell: /sbin/nologin
-
add: nsRoleDN
nsRoleDN: cn=nsmanageddisabledrole,dc=example,dc=org
-
delete: host

dn: uid=$USERNAME,ou=People,dc=example,dc=org
changetype: modify
delete: sshPublicKey" \
\
| ldapmodify -vc -x -ZZ -h $LDAPHOST -D "$BINDUSER" -w "$BINDPW"