From: Jule Anger <janger@samba.org>
Date: Fri, 1 Mar 2024 10:16:26 +0000 (+0100)
Subject: samba-tool: add "samba-tool user list --locked-only"
X-Git-Tag: tdb-1.4.11~1504
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=055b4cd50f8aeaac7ce1f3efc5643063025b28a7;p=thirdparty%2Fsamba.git

samba-tool: add "samba-tool user list --locked-only"

Signed-off-by: Jule Anger <janger@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
---

diff --git a/docs-xml/manpages/samba-tool.8.xml b/docs-xml/manpages/samba-tool.8.xml
index 3471b0e1991..e6c0c08c240 100644
--- a/docs-xml/manpages/samba-tool.8.xml
+++ b/docs-xml/manpages/samba-tool.8.xml
@@ -2598,6 +2598,12 @@
 	Do not list disabled user accounts.
 	</para></listitem>
 	</varlistentry>
+	<varlistentry>
+	<term>--locked-only</term>
+	<listitem><para>
+	Only list locked user accounts.
+	</para></listitem>
+	</varlistentry>
 	</variablelist>
 </refsect3>
 
diff --git a/python/samba/netcmd/user/list.py b/python/samba/netcmd/user/list.py
index 10605ca68f4..3d16f0ef9d7 100644
--- a/python/samba/netcmd/user/list.py
+++ b/python/samba/netcmd/user/list.py
@@ -42,6 +42,10 @@ class cmd_user_list(Command):
                default=False,
                action='store_true',
                help="Do not list disabled user accounts"),
+        Option("--locked-only",
+               help="Only list locked user accounts",
+               default=False,
+               action='store_true'),
         Option("-b", "--base-dn",
                help="Specify base DN to use",
                type=str),
@@ -64,6 +68,7 @@ class cmd_user_list(Command):
             H=None,
             hide_expired=False,
             hide_disabled=False,
+            locked_only=False,
             base_dn=None,
             full_dn=False):
         lp = sambaopts.get_loadparm()
@@ -87,10 +92,16 @@ class cmd_user_list(Command):
             filter_disabled = "(!(userAccountControl:%s:=%u))" % (
                 ldb.OID_COMPARATOR_AND, dsdb.UF_ACCOUNTDISABLE)
 
-        filter = "(&(objectClass=user)(userAccountControl:%s:=%u)%s%s)" % (
+        filter_locked = ""
+        if locked_only is True:
+            # use lockoutTime=* to filter out accounts without a set lockoutTime
+            filter_locked = "(&(lockoutTime=*)(!(lockoutTime=0)))"
+
+        filter = "(&(objectClass=user)(userAccountControl:%s:=%u)%s%s%s)" % (
             ldb.OID_COMPARATOR_AND,
             dsdb.UF_NORMAL_ACCOUNT,
             filter_disabled,
+            filter_locked,
             filter_expires)
 
         res = samdb.search(search_dn,