You can rename accounts with
ipa user-mod --rename
Thanks for the tip Alex
How did you disable it? 'ipa user-disable'? This just leaves this user in the tree and marks its account not possible to use for authentication.
Most likely one of my guys disabled accounts via the web interface.
Regards Angus
________________________________ From: Alexander Bokovoy abokovoy@redhat.com Sent: 22 August 2019 10:04 To: FreeIPA users list freeipa-users@lists.fedorahosted.org Cc: Angus Clarke post@angusclarke.com Subject: Re: [Freeipa-users] Disabled user accounts
On to, 22 elo 2019, Angus Clarke via FreeIPA-users wrote:
Hi all
Just an observation really, some of our users complained that their IdM login names did not match other systems' - we saw IdM as the easiest place to fix this (as opposed to modifying local accounts on hundreds of none-IdM enabled *nix boxes around the estate)
You can rename accounts with
ipa user-mod --rename
$ ipa user-mod some-user --rename=another-user ------------------------- Modified user "some-user" ------------------------- User login: another-user ....
Rightly or wrongly, the approach we took was to disable angusc account and add new account aclarke using the same UID number.
How did you disable it? 'ipa user-disable'? This just leaves this user in the tree and marks its account not possible to use for authentication.
One of our users spotted this happening occasionally:
[aclarke@orabledb ~]$ id uid=1234(angusc) gid=1234(aclarke) groups=1234(aclarke),2345(dbas)
We're now deleting the disabled accounts from IdM.
$ rpm -q ipa-server ipa-server-4.6.4-10.0.1.el7_6.3.x86_64
-- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland