On to, 22 elo 2019, Angus Clarke via FreeIPA-users wrote:
Hi all
Just an observation really, some of our users complained that their IdM
login names did not match other systems' - we saw IdM as the easiest
place to fix this (as opposed to modifying local accounts on hundreds
of none-IdM enabled *nix boxes around the estate)
You can rename accounts with
ipa user-mod --rename
$ ipa user-mod some-user --rename=another-user
-------------------------
Modified user "some-user"
-------------------------
User login: another-user
....
Rightly or wrongly, the approach we took was to disable angusc
account
and add new account aclarke using the same UID number.
How did you disable it?
'ipa user-disable'? This just leaves this user
in the tree and marks its account not possible to use for
authentication.
One of our users spotted this happening occasionally:
[aclarke@orabledb ~]$ id
uid=1234(angusc) gid=1234(aclarke) groups=1234(aclarke),2345(dbas)
We're now deleting the disabled accounts from IdM.
$ rpm -q ipa-server
ipa-server-4.6.4-10.0.1.el7_6.3.x86_64
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland