> You can rename accounts with
>
> ipa user-mod --rename

Thanks for the tip Alex

> How did you disable it? 'ipa user-disable'? This just leaves this user
> in the tree and marks its account not possible to use for
> authentication.

Most likely one of my guys disabled accounts via the web interface.

Regards
Angus


From: Alexander Bokovoy <abokovoy@redhat.com>
Sent: 22 August 2019 10:04
To: FreeIPA users list <freeipa-users@lists.fedorahosted.org>
Cc: Angus Clarke <post@angusclarke.com>
Subject: Re: [Freeipa-users] Disabled user accounts
 
On to, 22 elo 2019, Angus Clarke via FreeIPA-users wrote:
>Hi all
>
>Just an observation really, some of our users complained that their IdM
>login names did not match other systems' - we saw IdM as the easiest
>place to fix this (as opposed to modifying local accounts on hundreds
>of none-IdM enabled *nix boxes around the estate)

You can rename accounts with

ipa user-mod --rename

$ ipa user-mod some-user --rename=another-user
-------------------------
Modified user "some-user"
-------------------------
  User login: another-user
....


>Rightly or wrongly, the approach we took was to disable angusc account
>and add new account aclarke using the same UID number.
How did you disable it? 'ipa user-disable'? This just leaves this user
in the tree and marks its account not possible to use for
authentication.

>One of our users spotted this happening occasionally:
>
>
>[aclarke@orabledb ~]$ id
>uid=1234(angusc) gid=1234(aclarke) groups=1234(aclarke),2345(dbas)
>
>We're now deleting the disabled accounts from IdM.
>
>$ rpm -q ipa-server
>ipa-server-4.6.4-10.0.1.el7_6.3.x86_64

--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland