add check for DRP

terraform · Aug 1, 2025 · 8202e43 · 8202e43
1 parent 0d55977
commit 8202e43
Showing 1 changed file with 19 additions and 5 deletions.
diff --git a/local-app/bin/check-users.sh b/local-app/bin/check-users.sh
@@ -11,15 +11,16 @@ cleanup()
 }
 trap cleanup EXIT
 
-VERSION="1.1.1"
+VERSION="1.2.0"
 THIS=$(basename $0)
 export TMPDIR=$(/bin/mktemp -d /tmp/check-users.XXXXXXXX) || (echo "#* error making TMPDIR" && exit 1)
 #OUTFILE="$(basename $THIS .sh).$(date +%s).txt"
 OUTFILE="$TMPDIR/$(basename $THIS .sh).$(date +%s).txt"
 
-echo "is_separated,has_mail username employeeType loginDisabled mail"
+echo "is_separated,has_mail,is_admin_leave username employeeType loginDisabled mail"
 
 IS_SEPARATED=""
+IS_ADMIN_LEAVE=""
 NO_MAIL=""
 
 if [ -z "$1" ]
@@ -28,15 +29,17 @@ then
 else
   FILE=$1
 fi
+ADMINGROUP="cn=OIS Patriot GRB,ou=Lists,ou=MAIL,o=U.S. Census Bureau,c=US"
 
 ts=$(date +%s)
 c=0
 no_mail_count=0
 separated_count=0
+admin_leave_count=0
 for f in $(awk -F, 'NR>1 {print $1}' users.csv)
 do
   c=$(( c + 1 ))
-  /apps/terraform/bin/ldapsearch cn=$f dn employeeType mail loginDisabled > $OUTFILE
+  /apps/terraform/bin/ldapsearch cn=$f dn employeeType mail loginDisabled groupMembership > $OUTFILE
   dn_exists=$(grep -c ^dn $OUTFILE)
   mail=$(grep ^mail $OUTFILE|awk '{print $2}')
   error=0
@@ -63,6 +66,17 @@ do
     is_separated=0
   fi
 
+  adminleave=$(grep ^groupMembership $OUTFILE | grep -c "$ADMINGROUP")
+  if [[ $adminleave != 0 ]] && [[ $logindisabled == "TRUE" ]]
+  then
+    is_admin_leave=1
+    IS_ADMIN_LEAVE+=" $f"
+    admin_leave_count=$(( admin_leave_count + 1 ))
+    error=$(( error + 1 ))
+  else
+    is_admin_leave=0
+  fi
+
   if [[ $dn_exists == 0 ]]
   then
     et="not-present/no-jbid"
@@ -76,9 +90,9 @@ do
 
   if [ $error != 0 ]
   then
-    echo "$is_separated,$has_mail $f $et $logindisabled $mail"
+    echo "$is_separated,$has_mail,$is_admin_leave $f $et $logindisabled $mail"
   fi
 done
 te=$(date +%s)
 tx=$(( te - ts ))
-echo "summary: records $c no_mail_count $no_mail_count separated_count $separated_count elapsed $tx"
+echo "summary: records $c no_mail_count $no_mail_count separated_count $separated_count admin_leave_count $admin_leave_count elapsed $tx"